BitBox02 firmware

releases: add v9.26.1

securechip: cache ATECC serial number

Fix timer interrupt race

The production timer future shared its state through a RefCell, but
that state is touched from two different contexts: the poll_fn closure
runs in normal Rust task context, while the timer callback can run
from the hardware timer interrupt path.

If the interrupt fired while the future was polling, both sides could
try to take a mutable RefCell borrow at the same time. RefCell only
protects against reentrant borrowing within one thread of execution;
it is not a synchronization primitive for interrupt-vs-task access.
That made the timer future racy and able to fail nondeterministically
even with only one delay future in flight.

rust: put critical-section into workspace deps

simulator: fix factory_randomness

The C simulator still uses the BitBox02 Hal. The newly introduced
factory_randomness method there dereferenced the same static address
as on the device, leading to a segfault.

reset: do not loop forever in C simulator

A simulator regression from when we put `reboot` into the HAL. Before,
it was a no-op, and then it became a busy loop in bitbox02's System
HAL. This broke simulator tests in bitbox02-api-go.

bump version

rust: tweak Cargo flags for faster `cargo test`

securechip: make kdf async

Expose the OPTIGA crypt instance to Rust and route the\nKDF through the async command bridge. The higher-level\nsecurechip and application callers now await the operation\ninstead of relying on the synchronous C wrapper.

bitbox-core-utils: make salt::hash_data return 32 bytes

For better clarity and to remove needless try_into().unwrap().

hal/securechip: make kdf output 32 bytes

For better clarity.

hal/securechip: make kdf input 32 bytes

It is only used with that size, and simplifies the async port of that
function later.

optiga: add async bridge and counter read

Expose the shared OPTIGA util instance to Rust and route\nmonotonic_increments_remaining() through the async command\nbridge. This keeps the first async step small while exercising\nthe bridge with one real read operation.

rust: rename bitbox02-noise -> bitbox-noise

Use HAL random for noise key generation

bitbox02-rust should not depend on bitbox02-specific random types just
to initialize the Noise responder state. Move Noise key generation
onto bitbox_hal::Random and let bitbox02-noise initialize the
responder handshake from HAL-provided randomness.

This removes the old Random32/BB02Random32 plumbing. That trait
existed only because the handshake state was generic over a DH type
whose genkey() path generated the responder ephemeral internally. Once
the responder ephemeral is treated as explicit init input instead, the
state no longer needs a device-specific RNG type parameter. In the
final API, init() takes a HAL random source and derives that ephemeral
key there, which keeps the dependency boundary at bitbox-hal while
preserving the same handshake flow.

remove cmake run-rust-unit-tests custom target

hal: put noise key functions into Memory HAL

AGENTS.md: remove run-rust-unit-tests

AGENTS.md: no dev-exec.sh for `cargo` commands

They run on the host without ARM toolchain.

eth/sign: add missing mock_unlock in tests

api/payment_request: serialize ETH value as little endian

SLIP-24:

> amount (coinType-dependent length): fixed-length encoding of the amount of the requested output in little-endian byte order, expressed in the smallest unit of the given cryptocurrency (satoshis, wei, etc.). The length of the encoding is equal to the length used natively for the given coinType to encode amounts, e.g. 8 bytes for Bitcoin-like coins and 32 bytes for EVM assets.

ethereum/amount: fix typo in docstring

And switch to a more realistic unit :)

hal/securechip: mark monotonic_increments_remaining async

CHANGELOG: add swaps

payment_request: truncate long swap-to amounts

Same as amount.rs in Ethereum.

We apply it regardless of the coin target, as we can't enumerate
them (any ERC20 token etc. is possible).