Initial snapshot: Aliro applet, harness, Nucleo NFC10A1 reader port

Three components, all bench-validated to varying depths:

- applet/: CSA Aliro v1.0 Java Card applet for J3R180. AUTH0 + AUTH1
  expedited-standard flow end-to-end green via PC/SC bench reader
  (aliro-bench-test). Userland AES-256-GCM and HMAC-SHA-256 layered
  on top of J3R180's primitives because the card lacks both natively.
  P-256 curve params seeded explicitly per J3R180's quirk.

- harness/: Python orchestrator (aliro-trustgen, aliro-personalize,
  aliro-bench-test) for trust-bundle generation, card personalization
  via PersonalizationApplet, and PC/SC AUTH0+AUTH1 transactions. 126
  pytest cases passing.

- reader/STM32CubeExpansion_ALIRO_V1_0_0/: ST X-CUBE-ALIRO V1.0.0
  with our NFC10A1 port (NUCLEO-U545RE-Q + X-NUCLEO-NFC10A1, ST25R200
  shared with NFC09A1). nfc10-only/ project, NFC10A1 BSP shim,
  ALIRO_TRUST_OVERRIDE include into vendor's provisioning.c, and an
  ALIRO_APDU_TRACE wrapper around demoTransceiveBlocking. Boots,
  detects the J3R180, completes SELECT + AUTH0; AUTH1 currently fails
  with RFAL ERR_PROTO (0xB) — under investigation, see
  docs/plans/2026-04-20-nucleo-nfc10a1-port.md and bench-notes/.

Excluded: x-cube-aliro.zip vendor archive, harness/.venv, build dirs,
generated aliro_trust.h (contains private reader scalar), all PEMs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

harness/tests/test_reader_cli.py

@@ -0,0 +1,71 @@
+"""CLI-level tests for ``aliro-bench-test``.
+
+Mirrors ``test_personalizer_cli.py``. The pyscard import is lazy inside
+``main()`` so most of these tests don't need pcscd at all. Tests that
+exercise --list-readers monkeypatch ``smartcard.System.readers`` to keep
+them hermetic.
+"""
+
+from click.testing import CliRunner
+
+from aliro_harness.reader.cli import main
+
+
+def test_help_lists_both_modes():
+    result = CliRunner().invoke(main, ["--help"])
+    assert result.exit_code == 0, result.output
+    assert "--trust-dir" in result.output
+    assert "--list-readers" in result.output
+
+
+def test_bare_invocation_errors_with_clear_message_about_trust_dir():
+    result = CliRunner().invoke(main, [])
+    assert result.exit_code != 0
+    assert "--trust-dir" in result.output
+    # Click 8 prints "Error: ..." for UsageError; either wording is fine
+    # so long as trust-dir is mentioned.
+
+
+def test_list_readers_with_no_readers_exits_nonzero(monkeypatch):
+    """If pcscd reports no readers, --list-readers prints a message + exits 1."""
+    import smartcard.System
+
+    monkeypatch.setattr(smartcard.System, "readers", lambda: [])
+    result = CliRunner().invoke(main, ["--list-readers"])
+    assert result.exit_code == 1
+    # The message is printed to stderr; click.testing captures both into output.
+    assert "No PC/SC readers found" in result.output
+
+
+def test_list_readers_enumerates_each_with_index(monkeypatch):
+    """Two fake readers should be printed with [0] / [1] prefixes."""
+    import smartcard.System
+
+    class FakeReader:
+        def __init__(self, name: str) -> None:
+            self._name = name
+
+        def __str__(self) -> str:
+            return self._name
+
+    monkeypatch.setattr(
+        smartcard.System,
+        "readers",
+        lambda: [FakeReader("ACS Reader 0"), FakeReader("ACS Reader 1")],
+    )
+    result = CliRunner().invoke(main, ["--list-readers"])
+    assert result.exit_code == 0, result.output
+    assert "[0] ACS Reader 0" in result.output
+    assert "[1] ACS Reader 1" in result.output
+
+
+def test_list_readers_does_not_require_trust_dir(monkeypatch):
+    """The bug we're fixing: --list-readers should work standalone."""
+    import smartcard.System
+
+    monkeypatch.setattr(smartcard.System, "readers", lambda: [])
+    result = CliRunner().invoke(main, ["--list-readers"])
+    # Whatever the reader-discovery outcome, the failure mode must NOT be
+    # Click's "Missing option '--trust-dir'" usage error.
+    assert "Missing option" not in result.output
+    assert "--trust-dir is required" not in result.output