ed316102bf
Replaces the hardcoded 0x0005 in Table 8-11 with a computed value: - Bit 2 (step-up AID SELECT required) is always set — our architecture always uses split AID (5501 expedited + 5502 step-up) so the channel is always advertised, even when no AD is present. - Bit 0 (AD retrievable) is set only when hasAccessDocument() AND isAccessDocumentVerified() — we don't advertise a capability we can't deliver. The "finalized but not verified" branch is defensive (post-M2A.3 finalize requires verify) but matches the contract. Tests in AliroAppletAuth1Test: - auth1_bitmap_adNotProvisioned_returns0x0004 (replaces the old "all-zero" expectation — bit 2 is now always on) - auth1_bitmap_adProvisionedButNotVerified_returns0x0004 (new; uses markAccessDocumentFinalizedForTesting without markAccessDocumentVerified) - auth1_bitmap_adProvisionedAndVerified_returns0x0005 (the previous M2A.3 case, now correctly gated on the verified flag) Tests run: 147, Failures: 0, Errors: 3 (pre-existing GCM only).