Sorry not using CubeIDE so can't speak to it's efficacy.
Generally the debugger can't see inside of the QSPI either until you bring up the hardware properly, this is either done in code you run, or via a debugger script achieving the same. The latter is a bit involved.
Atollic could load two .ELF/HEX concurrently to permit the loader / app to interact. Keil could just use breakpoints (BKPT) you placed in the code.
You basically want two applications, a smaller loader that brings up the clocks and external memory interfaces (pins, memory mapping, and the like), and then that transfers control to the app in QSPI which has it's own Vector Table, and *doesn't* fiddle with the clocks/interface which are already viable.
I'd probably just break-point the loader at the point immediately before it transfers control, and then walk it across the border.
