Initial snapshot: Aliro applet, harness, Nucleo NFC10A1 reader port

Three components, all bench-validated to varying depths:

- applet/: CSA Aliro v1.0 Java Card applet for J3R180. AUTH0 + AUTH1
  expedited-standard flow end-to-end green via PC/SC bench reader
  (aliro-bench-test). Userland AES-256-GCM and HMAC-SHA-256 layered
  on top of J3R180's primitives because the card lacks both natively.
  P-256 curve params seeded explicitly per J3R180's quirk.

- harness/: Python orchestrator (aliro-trustgen, aliro-personalize,
  aliro-bench-test) for trust-bundle generation, card personalization
  via PersonalizationApplet, and PC/SC AUTH0+AUTH1 transactions. 126
  pytest cases passing.

- reader/STM32CubeExpansion_ALIRO_V1_0_0/: ST X-CUBE-ALIRO V1.0.0
  with our NFC10A1 port (NUCLEO-U545RE-Q + X-NUCLEO-NFC10A1, ST25R200
  shared with NFC09A1). nfc10-only/ project, NFC10A1 BSP shim,
  ALIRO_TRUST_OVERRIDE include into vendor's provisioning.c, and an
  ALIRO_APDU_TRACE wrapper around demoTransceiveBlocking. Boots,
  detects the J3R180, completes SELECT + AUTH0; AUTH1 currently fails
  with RFAL ERR_PROTO (0xB) — under investigation, see
  docs/plans/2026-04-20-nucleo-nfc10a1-port.md and bench-notes/.

Excluded: x-cube-aliro.zip vendor archive, harness/.venv, build dirs,
generated aliro_trust.h (contains private reader scalar), all PEMs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

harness/tests/test_kid.py

@@ -0,0 +1,45 @@
+"""Tests for the Aliro `kid` header derivation per spec \u00a77.2.1.
+
+The spec defines:
+    kid = SHA256("key-identifier" || 0x04 || IssuerKey_PubK.x || IssuerKey_PubK.y)[:8]
+
+where "key-identifier" is the literal ASCII string.
+"""
+
+import hashlib
+
+from cryptography.hazmat.primitives.asymmetric import ec
+
+from aliro_harness.issuer.kid import compute_issuer_kid
+
+
+def test_kid_is_8_bytes():
+    key = ec.generate_private_key(ec.SECP256R1())
+    kid = compute_issuer_kid(key.public_key())
+    assert isinstance(kid, bytes)
+    assert len(kid) == 8
+
+
+def test_kid_matches_spec_formula():
+    """Reference check: re-derive the kid from scratch and compare."""
+    key = ec.generate_private_key(ec.SECP256R1())
+    pub = key.public_key()
+    numbers = pub.public_numbers()
+    x_bytes = numbers.x.to_bytes(32, "big")
+    y_bytes = numbers.y.to_bytes(32, "big")
+    expected_input = b"key-identifier" + b"\x04" + x_bytes + y_bytes
+    expected_kid = hashlib.sha256(expected_input).digest()[:8]
+
+    assert compute_issuer_kid(pub) == expected_kid
+
+
+def test_kid_is_deterministic():
+    key = ec.generate_private_key(ec.SECP256R1())
+    pub = key.public_key()
+    assert compute_issuer_kid(pub) == compute_issuer_kid(pub)
+
+
+def test_kid_differs_for_different_keys():
+    key_a = ec.generate_private_key(ec.SECP256R1())
+    key_b = ec.generate_private_key(ec.SECP256R1())
+    assert compute_issuer_kid(key_a.public_key()) != compute_issuer_kid(key_b.public_key())