docs: M2 close-out draft — INSTALL.md acceptance criterion + step-up implementation notes (M2H.1 draft)

Adds the `aliro-bench-test --step-up` verification sub-section to
applet/INSTALL.md under "Validate after personalization" — explains
what the M2 path checks (SELECT-STEPUP / EXCHANGE / ENVELOPE / GET
RESPONSE / AD round-trip), what success looks like, and the three
common failure modes.

Also writes the user's auto-memory `step_up_implementation_notes.md`
(persisted outside this repo at
~/.claude/projects/.../memory/step_up_implementation_notes.md) with
the final form of the four Step-Up optimizations, spec citations, and
codebase pointers — so the operator can look up "how did Step-Up end
up" without re-reading the v2 plan. Three TODO markers left for the
M2H.1 final commit to update once M2E + M2F land.

DRAFT — final M2H.1 commit happens after M2G.2 verdict + M2E + M2F.

applet/INSTALL.md

@@ -193,6 +193,30 @@ step the real firmware will eventually run — so a green bench-test is
 strong evidence the applet is correct independently of any future
 reader implementation.
 
+### Step-Up M2 verification (`--step-up`)
+
+```
+aliro-bench-test --trust-dir ~/aliro-trust --step-up
+```
+
+Adds the Step-Up phase on top of the EXPEDITED verdict: SELECT-STEPUP
+(ACCE5502) derives session keys from the cached `StepUpSK`, EXCHANGE
++ ENVELOPE + chained GET RESPONSE drive a real mdoc DeviceRequest to
+the card and pull the encrypted DeviceResponse back. The harness
+decrypts under `StepUpSKDevice` and asserts the embedded Access
+Document round-trips byte-for-byte against the personalized blob.
+
+Successful output appends:
+
+```
+STEP-UP M2: OK — Access Document round-trip verified, 272 bytes match
+```
+
+A `STEP-UP M2: FAIL` line means one of: SELECT-STEPUP didn't arm
+(no preceding AUTH1), GCM tag mismatch (key/counter divergence), or
+the recovered AD bytes don't match. The Expedited block above still
+needs to be `OK` for any of this to run.
+
 ## Uninstall / re-install
 
 `gp --delete <pkg_AID>` won't succeed while applet *instances* still