BitBox02 firmware

keystore: move keystore_get_bip39_word_stack out of keystore.c

It has nothing to do with the keystore.

build: fix secp256k1 link order

Fix undefined secp256k1_* symbols when linking firmware. These errors
would happen if keystore.c stops referencing the secp256k1
symbols (see later commit).

We link libsecp256k1 as a static archive and the linker resolves
static libs left-to-right, only pulling in objects that satisfy
currently-unresolved symbols. Since the Rust archive introduces the
secp256k1_* references, it must appear before the secp256k1 library on
the link line (otherwise the linker scans secp256k1 too early and
doesn't pull the needed objects).

workflow/status: use delay_for instead of frame counter

readme: improve py/readme.md with install instructions

Added copy / pasteable instructions so that users without deeper
python knowledge can just use the python scripts.
i.e. users without knowledge about venv.

gitignore: ignore .venv directories

The venv module supports creating lightweight "virtual environments",
each with their own independent set of Python packages usually
installed in a local .venv directory.

These packages, should not be commited an can be ignored.

For example in case a user sets up a python virtual environment for
the python scripts in py directory.

deduplicate MAX_UNLOCK_ATTEMPTS define

pub consts in bitbox02-rust are exposed as defines in rust.h, so we
can drop the C defines.

build.rs: remove unused MAX_UNLOCK_ATTEMPTS

Its use in Rust was removed in 1266caf5800b589c5621612031f03d96d7def291.

optiga: remove redefinition

It's already in optiga.h

Move salt_root functions to HAL

Centralizes salt root access behind the HAL abstraction,
enabling full test isolation without C memory dependencies.

TestingHal initializes with a default salt root to preserve
existing test behavior without manual setup in each test.

The 2 rust_salt_hash_data tests keep using mock_memory() +
C-backed salt root because the extern "C" shim internally
constructs BitBox02Hal—these tests verify the FFI path works.

Moves "unlock_attempts" functions to HAL

rust: update toolchain to 1.92

There is a breaking change about abort_immediate_panic, see
CMakeLists.txt.

Also called `cargo update --precise 0.2.177 libc` in src/rust to align
the libc we use with the one in stdlib, to avoid a duplicate dep.

optiga: add _reset_counter util function

optiga: add initial optiga_test.c

The optiga sync ops functions are moved to a new file so they can be
faked in the unit test.

Some defines are moved from optiga.c to optiga.h to make them
available to the unit tests.

The unit test file itself fakes the optiga ops functions to a useful
degree.

The goal is to unit test the stretching algo based on fixtures, so we
can catch regressions.

optiga: remove unused hal_delay.h include

rust/util: add unit tests for rust_hmac_sha256/rust_hmac_sha512

And make sure overlaps are allowed explicitly, which we make use of
for example in atecc.c/optiga.c.

rust_sha256 code is also adjusted to be consistent in style (drop
`data` before using `out`).

optiga: move initialization code out of verify function

The verify_config function not only verified, but also set the
protection level and opened the util application.

This is part if moved out, so the verify function only verifies slot
metadata.

add initial AGENTS.md

To support agentic reviews and coding workflows.

It was generated using the codex init command, with some manual
modifications and extensions by myself.

Unsure if the docker instructions will work or are helpful, but we can
iterate this later.

Prevent memory_reset_hww from masking flash write failures

memory_reset_hww combined the CHUNK_1 write result and the
shared BLE chunk write using |=, so a later successful
write could hide an earlier failure. Change both writes to
be checked individually and return false on the first
failure, making the function only report success when all
flash writes succeed.

tests: remove C fake secure chip event counter

The events are counted in TestingHal now. The only check that is
removed is for root_fingerprint(), which does not use the HAL and so
is naturally not calling any securechip function.

hal: add Memory HAL

With unit tests for `password::enter`

hal: use u2f_counter_set

Somehow was missed when it was added HAL.

optiga: fix wrong error value

The error can basically not happen (it can only happen when the salt root
unset, which is never the case when Optiga functions are used).

bitbox02/memory: add unit test coverage

We will be adding all of these to a Memory HAL, so they will not be
indirectly tested anymore by all the tests in bitbox02-rust. We add
unit tests for them here, which serve as unit tests for the BitBox02
C memory functions.

port reset_reset to Rust

scripts/dockerenv: fix docker images compatbility

A new docker version defaults the output to some human readable
version that does not match the expected format, so the check always
fails in that case.

See also: https://github.com/docker/cli/issues/6650