feat: IssuerAuth verify at AD finalize + issuer pubkey provisioning (M2A.3)

Expands M2A.3 from the original plan because the credential issuer pubkey
had no provisioning path. Adds INS_SET_CREDENTIAL_ISSUER_PUBK = 0x25 to
PersonalizationApplet, bumps CredentialStore FIELD_VERSION 2 -> 3 to add
a 64 B credentialIssuerPubKey slot + set-flag, and pivots
finalizeAccessDocument to run a one-shot CoseVerifier RFC 9052
COSE_Sign1 verify against the staged AD bytes before atomically setting
accessDocumentLen + accessDocumentFinalized + accessDocumentVerified
inside a JCSystem transaction.

PersonalizationApplet holds one CoseVerifier instance constructed at
install (the 768 B CLEAR_ON_DESELECT scratch only allocates once) plus
a 65 B EEPROM scratch for staging the uncompressed issuer pubkey.

Status word mapping:
- missing issuer pubkey at finalize -> SW_CONDITIONS_NOT_SATISFIED (0x6985)
- IssuerAuth signature mismatch     -> SW_DATA_INVALID            (0x6984)
- length out of range               -> SW_WRONG_DATA               (0x6A80)
On verify failure the store stays untouched -- both
accessDocumentFinalized and accessDocumentVerified remain false.

Harness side: TrustArtifacts gains credential_issuer_pub (loaded from
trust_dir/issuer.pem). The orchestrator sends INS 0x25 after the
existing key writes and before the AD chunks so the trust anchor is
staged by the time FINALIZE_AD runs.

Test vector: AD bytes + matching issuer pubkey x||y are hardcoded into
PersonalizationAppletTest from the canonical trustgen artifacts at
/home/work/aliro-trust (272 B AD against a known issuer.pem).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

harness/tests/test_personalizer_apdus.py

@@ -5,12 +5,14 @@ import pytest
 from aliro_harness.personalizer.apdus import (
     CLA_PROPRIETARY,
     INS_COMMIT,
+    INS_SET_CRED_ISSUER_PUBK,
     INS_SET_CRED_PRIV,
     INS_SET_CRED_PUBK,
     INS_SET_READER_PUBK,
     PROVISIONING_AID,
     commit_apdu,
     select_provisioning_apdu,
+    set_credential_issuer_pubk_apdu,
     set_credential_priv_apdu,
     set_credential_pubk_apdu,
     set_reader_pubk_apdu,
@@ -55,6 +57,23 @@ def test_set_reader_pubk_apdu():
     assert apdu == bytes([CLA_PROPRIETARY, INS_SET_READER_PUBK, 0x00, 0x00, 0x40]) + pub
 
 
+def test_set_credential_issuer_pubk_apdu():
+    pub = bytes(range(64))
+    apdu = set_credential_issuer_pubk_apdu(pub)
+    # CLA INS P1 P2 Lc data — INS 0x25, same 64B x||y shape as cred_pubk
+    assert apdu == bytes([CLA_PROPRIETARY, INS_SET_CRED_ISSUER_PUBK, 0x00, 0x00, 0x40]) + pub
+
+
+def test_set_credential_issuer_pubk_rejects_wrong_length():
+    with pytest.raises(ValueError, match="64B"):
+        set_credential_issuer_pubk_apdu(bytes(63))
+
+
+def test_ins_set_cred_issuer_pubk_constant_matches_applet():
+    """Lock-down: applet PersonalizationApplet.INS_SET_CREDENTIAL_ISSUER_PUBK = 0x25."""
+    assert INS_SET_CRED_ISSUER_PUBK == 0x25
+
+
 def test_commit_apdu_has_no_data_field():
     apdu = commit_apdu()
     assert apdu == bytes([CLA_PROPRIETARY, INS_COMMIT, 0x00, 0x00])

harness/tests/test_personalizer_orchestrator.py

@@ -8,6 +8,7 @@ from aliro_harness.issuer.access_document import build_access_document
 from aliro_harness.personalizer.apdus import (
     INS_COMMIT,
     INS_FINALIZE_ACCESS_DOC,
+    INS_SET_CRED_ISSUER_PUBK,
     INS_SET_CRED_PRIV,
     INS_SET_CRED_PUBK,
     INS_SET_READER_PUBK,
@@ -46,6 +47,7 @@ def artifacts() -> TrustArtifacts:
         credential_priv=extract_priv_scalar(cred),
         credential_pubk_xy=extract_pub_xy(cred.public_key()),
         reader_pubk_xy=extract_pub_xy(reader.public_key()),
+        credential_issuer_pub=extract_pub_xy(issuer.public_key()),
         access_document=build_access_document(
             issuer_private_key=issuer,
             access_credential_public_key=cred.public_key(),
@@ -58,17 +60,35 @@ def test_full_sequence_in_expected_order(artifacts):
     personalize_card(transport, artifacts)
 
     insns = [apdu[1] for apdu in transport.sent]
-    # SELECT (0xA4) → SET_PRIV → SET_PUBK → SET_READER_PUBK → WRITE_AD+ → FINALIZE_AD → COMMIT
+    # SELECT (0xA4) → SET_PRIV → SET_PUBK → SET_READER_PUBK →
+    #   SET_CRED_ISSUER_PUBK → WRITE_AD+ → FINALIZE_AD → COMMIT.
+    # SET_CRED_ISSUER_PUBK must land BEFORE WRITE_AD chunks so that by
+    # the time FINALIZE runs, the issuer trust anchor is staged.
     assert insns[0] == 0xA4
     assert insns[1] == INS_SET_CRED_PRIV
     assert insns[2] == INS_SET_CRED_PUBK
     assert insns[3] == INS_SET_READER_PUBK
+    assert insns[4] == INS_SET_CRED_ISSUER_PUBK
     # AD writes (variable count) then a single finalize, then commit.
-    assert all(i == INS_WRITE_ACCESS_DOC for i in insns[4:-2])
+    assert all(i == INS_WRITE_ACCESS_DOC for i in insns[5:-2])
     assert insns[-2] == INS_FINALIZE_ACCESS_DOC
     assert insns[-1] == INS_COMMIT
 
 
+def test_credential_issuer_pubk_apdu_carries_exact_bytes(artifacts):
+    transport = FakeTransport()
+    personalize_card(transport, artifacts)
+    # Find the INS_SET_CRED_ISSUER_PUBK APDU.
+    issuer_apdu = next(a for a in transport.sent if a[1] == INS_SET_CRED_ISSUER_PUBK)
+    # CLA INS P1 P2 Lc data
+    assert issuer_apdu[0] == 0x80
+    assert issuer_apdu[2] == 0x00
+    assert issuer_apdu[3] == 0x00
+    assert issuer_apdu[4] == 0x40  # Lc = 64
+    assert issuer_apdu[5:] == artifacts.credential_issuer_pub
+    assert len(artifacts.credential_issuer_pub) == 64
+
+
 def test_select_apdu_carries_provisioning_aid(artifacts):
     transport = FakeTransport()
     personalize_card(transport, artifacts)