They're defaults, not overrrides: given that you presumably already ran menuconfig, you have a good set of configs in sdkconfig so the defaults file does nothing. Try removing that file and the defaults should apply.

It shouldn't do that, indeed. What ESP-IDF version do you use and can you share your project?

Looks like you managed to kill the flash chip, or one of the ESP IO pins that connect there.

I personally have good experiences with the HT7833 chips, but there are others that may be more applicable to your situation.

Define 'intermittent shutdown'? What specifically happens?

That'll kill the devboard indeed. Yes, you can cut it and resolder them, make sure that the wires can't short (ideally use heatshrink tube to isolate them, if not tape will work)

No, it generally doesn't, sorry. The memory map on the ESP32 is a bit weird wrt fragmentation; as you noticed we improved on that with the S3.

The MCP1700 can only deliver 250mA. We highly recommend feeding ESP chips with a power supply capable of delivering >=500mA.

Yes, SiP is also included in 'off-chip' flash. Whether the packaging itself already is enough protection depends on your threat model, see e.g. here for a demonstration (on STM32 clone chips) where it might not be.

You can look at the EXCVADDR in the stack dump. I'm going by heuristics from seeing lots of valid addresses during my years at Espressif and going like 'this ain't one', but you can check the memory map in the TRM if you want to be sure. (Generally, valid addresses tend to start with 0x40 or 0x3f.)