BitBox02 firmware

Disable Rust Debug formatting

Pass `-Zfmt-debug=none` in the firmware Rust build.

According to
clippy::no_debug (https://rust-lang.github.io/rust-clippy/master/index.html?search=use_debug):

> It should not be used in user-facing output

This tells rustc not to emit normal `Debug` formatter implementations into
the cross-compiled firmware image. The option also makes `{:?}` print
nothing, so app-visible error status messages must not rely on derived
`Debug`.

Keep the live keystore and backup error status screens explicit by formatting
those errors through small match-based helpers instead of `Debug`. This
preserves the visible diagnostic strings while still allowing derived Debug
formatting to be compiled out of the firmware.

There are still live library `Debug` formatting paths in a no-flag build even
when our callers map those errors to `InvalidInput`. Protobuf and Miniscript
parsers construct detailed errors internally before the caller discards them,
for example `WireType` decode errors and Miniscript `NonTopLevel(format!("{:?}",
...))` errors. `fmt-debug=none` prevents those detailed `Debug` formatters and
their generic formatting helpers from being linked.

Savings: 6464 bytes

Enable blake2 size_opt

The blake2 crate exposes a size_opt feature that trades aggressive
inlining for a smaller implementation. In this firmware build the
Blake2b compression path was still one of the largest Rust code
contributors, so this is a direct ROM for speed trade that matches the
current goal.

Enable size_opt for the existing optional dependency. The algorithm,
test vectors, and call sites stay the same; only the crate internal
code generation strategy changes.

In the resulting image, the large Blake2b compression routine is split
into much smaller outlined helpers instead of one heavily inlined
body. That is where the ROM reduction comes from.

Saves 11576 bytes in firmware.bin.

mbedtls: use RAM instead of ROM to shrink size

Saves 2104 bytes.

Shrink mbedtls SHA256 core

Enable MBEDTLS_SHA256_SMALLER in the Optiga Trust M mbedTLS
user config.

This keeps the same SHA256 and HMAC-SHA256 behavior, but switches
mbedTLS to its smaller SHA256 implementation for the live Optiga
crypto path.

Savings: 1392 bytes.

The main win is that mbedtls_internal_sha256_process shrinks by
1396 bytes in the final image. The surrounding PAL, HMAC, and CCM
entry points remain live, so this is a pure ROM-for-speed tradeoff
rather than a functionality change.

Shrink mbedtls AES tables

Enable MBEDTLS_AES_FEWER_TABLES in the Optiga Trust M mbedTLS
user config.

This keeps the same AES/CCM functionality, but trades a small
amount of AES speed for smaller ROM usage by deriving the extra
AES lookup tables from FT0/RT0 instead of keeping all eight
tables in flash.

- savings: 6208 bytes

The main win is that six live 1024-byte AES tables drop out of
the final image: FT1, FT2, FT3, RT1, RT2, and RT3. FT0 and RT0
remain, and the AES encrypt/decrypt functions shrink slightly as
well.

No functionality changes are intended; this is a ROM-for-speed
tradeoff in the mbedTLS AES implementation used by the Optiga
Trust M integration.

Shrink secp256k1 callbacks

Override libsecp256k1's default callbacks with tiny local stubs.

The vendored callbacks print an error and then call abort(). In the
firmware image those failure-only paths pull in a large chunk of newlib
stdio and signal handling even though the callbacks are only used for
fatal illegal-argument and internal-consistency failures and must never
return.

Saved: 2672 bytes

The final linked image drops the abort/stdio path retained only by those
callbacks, including the public symbols abort, raise, _raise_r,
_kill_r, _getpid_r, fprintf, printf, and _vfprintf_r. It also drops the
private stdio helpers behind them, such as __sfputc_r, __sfputs_r,
__swsetup_r, __swbuf_r, _fflush_r, _fwalk_sglue, __swhatbuf_r,
__swrite, __sread, __sseek, __sclose, __sinit, and __smakebuf_r.
Meanwhile secp256k1_default_illegal_callback_fn and
secp256k1_default_error_callback_fn shrink from 28 bytes each to 2
bytes each.

This keeps the relevant behavior intact: both callbacks still trap the
firmware in a non-returning fatal path, but without dragging in unused
diagnostic formatting code.

drop unneeded -mlong-calls

Firmware builds for Cortex-M4 in Thumb mode, where direct BL calls
reach roughly +/-16 MiB. The firmware image is well within that range,
so forcing -mlong-calls only bloats call sites and C code built
through Rust build scripts.

Remove -mlong-calls from the cross-compilation C flags and from
CARGO_C_FLAGS so the compiler can emit direct calls again.

This saves 11432 bytes in firmware.bin.

optiga: inline async launches

Each Optiga async wrapper currently goes through a generic async
helper that accepts a per-call launch closure. That shape is expensive
in firmware builds: every distinct closure type causes another
monomorphized async state machine, along with duplicate drop glue and
wrapper-specific launch/wait/cleanup control flow.

Inline the Optiga C launch in each wrapper instead and keep only a
non-generic shared wait/cleanup helper. The async behavior does not
change: begin_async_op()/AsyncOpGuard still owns the shared static
buffers, Detached recovery still prevents buffer reuse after
cancellation, and all zeroization and length checks remain in place.

This saves about 1400 bytes in the firmware binary because the
compiler no longer needs to materialize a separate future for each
Optiga operation wrapper just to carry a different launch closure. The
launch step becomes plain local code in each wrapper, while the common
polling and cleanup path stays shared in one non-generic async helper.

optiga: remove unused interface bits

securechip: port U2F counter ops

securechip: port attestation sign

securechip: make random async

assert 9.26.1

Format generated protobufs explicitly

Run rustfmt from the explicit protobuf regeneration script and include
the generated Rust files in check-style.

This keeps firmware builds working by avoiding formatting inside the
generator/build path while making the manual regen workflow produce
style-clean committed outputs.

Move protobuf bindings into bitbox-proto

Add a committed bitbox-proto crate for the generated Rust protobuf
bindings.

Switch regeneration to a Cargo-driven flow, add a make shortcut and CI
drift check, and keep the generator copy-on-change so no-op regen runs
do not churn timestamps or invalidate build caches.

optiga: dedup busy polling

Share the busy-wait polling logic between reclaim_detached_op() and
wait() in the async Optiga wrapper.

This keeps the async behavior unchanged while shaving a small amount of
future state-machine code from the firmware.

port lost docstring from deleted C code

tighten types

securechip: port password ops

Move the OPTIGA password flows into Rust in one step, including the async command wrappers and the migrated unit tests. This keeps the commit focused on the securechip password migration itself; the unrelated Box::pin(...) call-site changes were split into a separate commit.

util/sha2: fix safety docs syntax

securechip: change output type of password stretch to [u8; 32]

Encode size in type for clarity.

Simulate securechip stretching as well

ui: don't show waiting screen during password stretch

Before the securechip operations became async, the UI did not process
during keystore unlock and froze at the last screen of the password
confirmation, and UI continued with the BIP39 unlock animation.

Now that they are async, the password screen is popped and the waiting
screen would be shown for roughly 1s before the unlock animation
started. To improve UI there, we start showing first screen of the
unlock animation (the locked lock) as the filler screen.

Instead of the default waiting screen being shown, during these
operations the first animation frame component is shown and held, with
animation starting only in bip39_unlock.

The downside is that when entering the wrong password, it is also
briefly shown before the wrong-password error message, but it's
acceptable.

There are other workflows where the waiting screen is also shown
during the stretch, not addresed by this commit: show mnemonic, create
backup, and change password (any call to
`workflows::unlock::unlock_keystore()` to check the password).

Co-Authored-By: Niklas Dusenlund <niklas.dusenlund@bitbox.swiss>

simulator-graphical: fix factory_randomness

Same as cee5bdb3ba06f60b93213f9c2a183a7683fe1551, but for BB02
graphical simulator.

bitbox02_rust: remove mock_memory

All tests use HAL now.