fix: AUTH1 crypto interop with stock X-CUBE-ALIRO + EXCHANGE compat stub

Three independent spec-misreads found via Path X investigation against
the X-CUBE-ALIRO vendor library, all causing
ACWG_Error_Crypto_EncryptDecrypt on the vendor's processAUTH1ResponsePayload.
Each was symmetric between this applet and our PC/SC reader, so
aliro-bench-test passed against our own host-side reader but failed
against any spec-compliant third-party reader. Path X also surfaced
an X-CUBE-ALIRO-specific compat shim (bitmap + EXCHANGE stub) which is
documented to be retired by the Step-Up Milestone 1 work.

1. salt_volatile dropped x(credential_long_term_pub) at the end.
   §8.3.1.13 salt_volatile ends at the 0xA5 proprietary information TLV;
   the credential key belongs in `info` (and even there it's the
   EPHEMERAL one, which buildInfo already does correctly).

2. Kdh now uses X9.63 KDF per §8.3.1.4 instead of HKDF.
   The §8.3.1.4 closing note ("actual key derivation is performed using
   §8.3.1.5") refers to subsequent session-key derivation from Kdh
   (§8.3.1.13 -> §8.3.1.5 HKDF), NOT a substitution for Kdh itself.
   For 32-byte output X9.63 KDF reduces to:
     Kdh = SHA-256(ZAB || 0x00000001 || transaction_identifier)
   Added a native SHA-256 instance to AliroCrypto for this one-shot.

3. salt_volatile flag uses AUTH1's command_parameters, not AUTH0's.
   §8.3.1.13 says "command_parameters || authentication_policy from the
   command data field". When §8.3.1.13 runs (after AUTH1), the active
   request is AUTH1; authentication_policy only exists in AUTH0 so it's
   still pulled from saved AUTH0 state, but command_parameters is the
   AUTH1 value (typically 0x01 = "request credential_PubK in response").

4. signaling_bitmap kept at 0x0005 when AD provisioned + INS_EXCHANGE
   stub on AliroApplet returns 9000 with empty payload. Empirically the
   X-CUBE-ALIRO vendor library errors on bitmap=0x0000 even though the
   spec allows it (separate vendor quirk worth filing); EXCHANGE stub
   exists because the firmware unconditionally sends 0xC9 post-AUTH1
   for the Reader Status sub-event report. Both shims are documented to
   be retired in Step-Up Milestone 1 -- StepUpApplet will handle 0xC9
   on its own AID (ACCE5502) per §10.2.1 after the spec-mandated
   step-up AID SELECT.

PC/SC bench-test still passes: AUTH1=9000, ~3.2 s, bitmap=0x0005.
Nucleo X-CUBE-ALIRO firmware now reports retval=ACWG_OK on
processAUTH1ResponsePayload (confirmed against j3r452 UID
04565E4A0B2190 in /tmp/nucleo-three-fixes.log). The remaining
"DOOR OPERATION FAILED" on Nucleo is downstream Step-Up not being
implemented yet -- StepUpApplet is still the scaffold and returns
6D00/6E00 to ENVELOPE / EXCHANGE. That's Milestone 1 work.

80/80 Java tests + 126/126 Python tests pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

harness/tests/fake_card.py

@@ -280,6 +280,11 @@ class FakeAliroCard:
         if not self._verify_reader_sig(table_812, reader_raw_sig):
             return b"", 0x6A80
 
+        # §8.3.1.13 flag uses the AUTH1 command_parameters (not AUTH0's).
+        # Overwrite the AUTH0 value stored on the session so _derive_sk_device
+        # builds salt_volatile with the right byte.
+        self.session.command_parameters = cmd_params
+
         # Derive session keys
         sk_device = self._derive_sk_device()
 
@@ -362,9 +367,8 @@ class FakeAliroCard:
             txn_id,
         )
 
-        # x-coords
+        # x-coord for the reader long-term key
         reader_long_term_x = self._pub_x(self.reader_pub)
-        credential_long_term_x = self._pub_x(self.credential_pub)
 
         salt = build_salt_volatile(
             reader_long_term_pub_x=reader_long_term_x,
@@ -374,7 +378,6 @@ class FakeAliroCard:
             transaction_id=txn_id,
             command_parameters=self.session.command_parameters,
             authentication_policy=self.session.authentication_policy,
-            credential_long_term_pub_x=credential_long_term_x,
         )
 
         info = cred_ephem_pub[1:33]

harness/tests/test_reader_key_derivation.py

@@ -13,7 +13,6 @@ def test_salt_volatile_layout_per_spec_8_3_1_13():
         transaction_id=b"\xcc" * 16,
         command_parameters=0x00,
         authentication_policy=0x00,
-        credential_long_term_pub_x=b"\x55" * 32,
     )
     p = 0
     assert salt[p : p + 32] == b"\x01" * 32  # x(reader_group_identifier_key)
@@ -38,9 +37,10 @@ def test_salt_volatile_layout_per_spec_8_3_1_13():
     p += 2
     assert salt[p : p + 10] == bytes.fromhex("A50880020000 5C020100".replace(" ", ""))
     p += 10
-    assert salt[p : p + 32] == b"\x55" * 32  # x(credential_long_term)
-    p += 32
-    assert len(salt) == p == 173
+    # salt_volatile ends at the 0xA5 TLV per spec §8.3.1.13. The
+    # credential_long_term_pub_x previously appended here was a misread of
+    # the spec (caused vendor library ACWG_Error_Crypto_EncryptDecrypt).
+    assert len(salt) == p == 141
 
 
 def test_salt_volatile_threads_flag_bytes_in_correct_order():
@@ -53,7 +53,6 @@ def test_salt_volatile_threads_flag_bytes_in_correct_order():
         transaction_id=b"\x00" * 16,
         command_parameters=0xAB,
         authentication_policy=0xCD,
-        credential_long_term_pub_x=b"\x00" * 32,
     )
     # flag offset: 32 + 12 + 16 + 16 + 1 + 2 + 2 + 32 + 16 = 129
     assert salt[129] == 0xAB
@@ -62,7 +61,7 @@ def test_salt_volatile_threads_flag_bytes_in_correct_order():
 
 def test_derive_expedited_session_keys_returns_160_bytes_deterministic():
     kdh = bytes.fromhex("11" * 32)
-    salt = bytes.fromhex("22" * 173)
+    salt = bytes.fromhex("22" * 141)
     info = bytes.fromhex("33" * 65)  # x(credential_ephem_pub) is 32B in practice; any bytes OK here
     out1 = derive_expedited_session_keys(kdh, salt, info)
     out2 = derive_expedited_session_keys(kdh, salt, info)
@@ -72,7 +71,7 @@ def test_derive_expedited_session_keys_returns_160_bytes_deterministic():
 
 def test_derive_expedited_session_keys_changes_with_inputs():
     kdh = bytes.fromhex("11" * 32)
-    salt_a = bytes.fromhex("22" * 173)
-    salt_b = bytes.fromhex("23" + "22" * 172)
+    salt_a = bytes.fromhex("22" * 141)
+    salt_b = bytes.fromhex("23" + "22" * 140)
     info = bytes.fromhex("33" * 32)
     assert derive_expedited_session_keys(kdh, salt_a, info) != derive_expedited_session_keys(kdh, salt_b, info)