chore(applet): drop M1 stub comments + dead paths + naming consistency (M2F.2)

Sweep stale M1-era cruft and milestone task markers obsoleted by M2:

- StepUpApplet class Javadoc: fix stale @link target for
  finalizeAccessDocument (now takes verifier+scratch65), drop "TODO"
  prose for shipped M2A.3 verify-at-finalize, rewrite "INS_EXCHANGE stub
  was retired" past-tense note as present-tense ownership statement.
- StepUpApplet: drop "M1B / M1C" / "M2E.1" / "M2E.2" / "M2D.3+M2D.4"
  task markers from comments and method Javadocs; describe current
  behavior, not milestone provenance.
- StepUpApplet: rewrite "decrypt-and-discard" sink Javadoc — that sink
  now also stages the EXCHANGE Reader Status request plaintext.
- StepUpSession: drop "matching M1 behaviour" Javadoc trailers.
- AliroApplet bitmap comment: align with the new method name and drop
  the M1 historical aside that's now adjacent to the only behavior left.
- AliroAppletTest: rewrite "Once M1B.1 / M1C.1 land..." as present tense.
- CredentialStore.markAccessDocumentVerified() → ForTesting suffix to
  match the sibling markAccessDocumentFinalizedForTesting() and add an
  explanatory Javadoc clarifying that production callers reach the
  verified state via finalizeAccessDocument(short, CoseVerifier, byte[]).
  Two test call sites updated.

No behavior change. Tests: 147 / 0 / 3 pre-existing GCM errors. Net
diff +46/-44 = +2 LOC (the rename's explanatory Javadoc minus the cruft).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

applet/src/test/java/com/dangerousthings/aliro/AliroAppletAuth1Test.java

@@ -215,7 +215,7 @@ class AliroAppletAuth1Test {
         org.junit.jupiter.api.Assertions.assertTrue(
             CredentialStore.get().writeAccessDocumentChunk(ad, (short) 0, (short) 0, (short) ad.length));
         CredentialStore.get().markAccessDocumentFinalizedForTesting((short) ad.length);
-        CredentialStore.get().markAccessDocumentVerified();
+        CredentialStore.get().markAccessDocumentVerifiedForTesting();
 
         sendStandardAuth0();
         ResponseAPDU r = sendValidAuth1();

applet/src/test/java/com/dangerousthings/aliro/AliroAppletTest.java

@@ -95,12 +95,12 @@ class AliroAppletTest {
 
     @Test
     void auth1ExchangeInsRejectedNowThatStepUpAppletOwnsIt() {
-        // Once M1B.1 / M1C.1 land StepUpApplet (ACCE5502) as the proper owner
-        // of INS_EXCHANGE (0xC9), AliroApplet must NOT also answer 0xC9 — a
-        // spec-conformant reader routes EXCHANGE to ACCE5502 after the §10.2
-        // step-up AID SELECT. AliroApplet receiving 0xC9 is a reader bug or
-        // a stale flow, and must be rejected with SW_INS_NOT_SUPPORTED so it
-        // can never accidentally interact with expedited session state.
+        // StepUpApplet (ACCE5502) owns INS_EXCHANGE (0xC9); AliroApplet must
+        // NOT also answer 0xC9 — a spec-conformant reader routes EXCHANGE to
+        // ACCE5502 after the §10.2 step-up AID SELECT. AliroApplet receiving
+        // 0xC9 is a reader bug or a stale flow, and must be rejected with
+        // SW_INS_NOT_SUPPORTED so it can never accidentally interact with
+        // expedited session state.
         selectExpedited();
         CommandAPDU exchange = new CommandAPDU(0x80, 0xC9, 0x00, 0x00);
         ResponseAPDU resp = sim.transmitCommand(exchange);

applet/src/test/java/com/dangerousthings/aliro/CredentialStoreSerializationTest.java

@@ -97,7 +97,7 @@ class CredentialStoreSerializationTest {
     void accessDocumentVerifiedRoundTripsThroughSerialize() {
         CredentialStore s1 = CredentialStore.bootstrap();
         s1.resetForTesting();
-        s1.markAccessDocumentVerified();
+        s1.markAccessDocumentVerifiedForTesting();
 
         RecordingSink buf = new RecordingSink();
         s1.writeTo(buf);