Add stm32u5a9j-dk-build

### src/rust/Cargo.lock
@@ -126,6 +126,13 @@ dependencies = [
  "bitbox-platform-stm32u5-sys",
 ]
 
+[[package]]
+name = "bitbox-board-stm32u5a9j-dk-build"
+version = "0.1.0"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "bitbox-board-stm32u5a9j-dk-sys"
 version = "0.1.0"

### src/rust/Cargo.toml
@@ -6,6 +6,7 @@ members = [
     "async_test",
     "bitbox-aes",
     "bitbox-board-stm32u5a9j-dk",
+    "bitbox-board-stm32u5a9j-dk-build",
     "bitbox-board-stm32u5a9j-dk-sys",
     "bitbox-boot-utils",
     "bitbox-bytequeue",

### src/rust/bitbox-board-stm32u5a9j-dk-build/Cargo.toml
@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: Apache-2.0
+
+[package]
+name = "bitbox-board-stm32u5a9j-dk-build"
+version = "0.1.0"
+edition = "2024"
+authors = ["Shift Crypto AG <support@bitbox.swiss>"]
+description = "Build helpers for the STM32U5 DK board support"
+license = "Apache-2.0"
+
+[dependencies]
+cc = { version = "1.2", features = ["parallel"] }

### src/rust/bitbox-board-stm32u5a9j-dk-build/src/lib.rs
@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: Apache-2.0
+
+use std::path::Path;
+use std::process::Command;
+
+const ST_DEFINES: &[&str] = &["USE_HAL_DRIVER", "STM32U5A9xx"];
+const ST_DEBUG_DEFINES: &[(&str, &str)] = &[("USE_FULL_ASSERT", "1U")];
+
+const ST_INCLUDES: &[&str] = &[
+    "Common/Inc",
+    "stm32u5a9j-dk/Inc",
+    "Drivers/STM32U5xx_HAL_Driver/Inc",
+    "Drivers/STM32U5xx_HAL_Driver/Inc/Legacy",
+    "Drivers/CMSIS/Device/ST/STM32U5xx/Include",
+    "Drivers/CMSIS/Include",
+];
+
+pub fn build_hal_overrides_object(repo_root: &Path, out_dir: &Path) {
+    println!("cargo::rerun-if-env-changed=PROFILE");
+
+    let st_root = repo_root.join("external/ST");
+    let source = st_root.join("stm32u5a9j-dk/Src/stm32u5xx_hal_msp.c");
+    let output = out_dir.join("hal_overrides.o");
+
+    println!("cargo::rerun-if-changed={}", source.display());
+    for include in ST_INCLUDES {
+        println!(
+            "cargo::rerun-if-changed={}",
+            st_root.join(include).display()
+        );
+    }
+
+    let mut build = cc::Build::new();
+    for define in ST_DEFINES {
+        build.define(define, None);
+    }
+    if std::env::var("PROFILE").expect("PROFILE not set") != "release" {
+        for (key, value) in ST_DEBUG_DEFINES {
+            build.define(key, Some(*value));
+        }
+    }
+    for include in ST_INCLUDES {
+        build.include(st_root.join(include));
+    }
+    build.flag_if_supported("-w");
+
+    let compiler = build.get_compiler();
+    let mut command: Command = compiler.to_command();
+    // Compile stm32u5xx_hal_msp.c into a standalone object instead of putting it into a static
+    // archive. The final binaries already pull in a weak HAL_MspInit from stm32u5xx_hal.c via the
+    // platform sys archive, so a separate libhal_overrides.a linked with rustc-link-lib would
+    // usually not be extracted: by that point the symbol is no longer unresolved. Linking a raw
+    // .o through each top-level build script makes the strong HAL_MspInit participate in the final
+    // link unconditionally, which reliably overrides the weak default.
+    command.arg("-c");
+    command.arg(&source);
+    command.arg("-o");
+    command.arg(&output);
+
+    let status = command.status().expect("compile hal_overrides.o");
+    assert!(status.success(), "failed to compile hal_overrides.o");
+
+    println!("cargo::rustc-link-arg={}", output.display());
+}