docs: Step-Up implementation plans v1+v2 + inline TODOs at four opt sites

Two plans land:

- 2026-06-07-step-up-implementation.md (v1): original 6-phase plan
  written before the Path X session. Captured the four optimizations
  (opt 1: reuse AliroGcm; opt 2: structural CBOR only; opt 3:
  stream-encrypt during ENVELOPE emit; opt 4: cache IssuerAuth verify
  at personalization) and the spec citations for each. Superseded by v2
  but retained for the planning-history record.

- 2026-06-11-step-up-implementation-v2.md: revised after Path X
  resolved the three crypto bugs. Splits into Milestone 1 (~400 LOC,
  4-6 hours, gets DOOR OPERATION SUCCEEDED on stock X-CUBE-ALIRO with
  decrypt-and-discard stubs) and Milestone 2 (~1500 LOC, 1-2 weeks,
  real Access Document retrieval via mdoc DeviceResponse + CBOR + COSE).
  The four optimizations are preserved into M2 where they matter; M1
  ships without them since the demo doesn't need real document
  payload yet.

Inline TODO comments mark the four optimization sites in source:

- CredentialStore.finalizeAccessDocument -- opt 4a (verify-flag in a
  JCSystem.beginTransaction block) + opt 4b (Credential Issuer key
  rotation assumption documented).

- StepUpApplet class javadoc -- all four optimizations laid out so the
  implementer (subagent or human) lands them as they build the body.

(The AliroApplet INS_EXCHANGE comment that references the plans is
in the previous fix commit; it'll move/retire when M1 lands.)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

applet/src/main/java/com/dangerousthings/aliro/CredentialStore.java

@@ -176,6 +176,18 @@ final class CredentialStore {
      * Marks the Access Document as provisioned with {@code totalLen} bytes
      * of valid content starting at offset 0. Returns false (and does not
      * mutate state) if {@code totalLen} is outside {@code [0, ACCESS_DOC_MAX_LEN]}.
+     *
+     * <p>TODO (Step-Up impl, opt 4a): wrap this in
+     * {@code JCSystem.beginTransaction()} along with a one-shot IssuerAuth
+     * COSE_Sign1 verify against the stored Credential Issuer public key, and
+     * set a persistent {@code accessDocumentVerified} flag. Caching the
+     * verify result saves ~100 ms per Step-Up transaction at the cost of one
+     * extra persistent byte + the assumption that the Credential Issuer
+     * trust anchor is fixed for the card's lifetime (opt 4b — true for DT's
+     * implantable use case but document the limitation). The verify-flag
+     * write and the {@code accessDocumentFinalized} flip MUST land in the
+     * same atomic transaction so partial state can't ship an unverified
+     * document marked verified.
      */
     boolean finalizeAccessDocument(short totalLen) {
         if (totalLen < 0 || totalLen > ACCESS_DOC_MAX_LEN) {