Replaces the hardcoded 0x0005 in Table 8-11 with a computed value:
- Bit 2 (step-up AID SELECT required) is always set — our architecture
always uses split AID (5501 expedited + 5502 step-up) so the channel
is always advertised, even when no AD is present.
- Bit 0 (AD retrievable) is set only when hasAccessDocument() AND
isAccessDocumentVerified() — we don't advertise a capability we
can't deliver. The "finalized but not verified" branch is defensive
(post-M2A.3 finalize requires verify) but matches the contract.
Tests in AliroAppletAuth1Test:
- auth1_bitmap_adNotProvisioned_returns0x0004 (replaces the old
"all-zero" expectation — bit 2 is now always on)
- auth1_bitmap_adProvisionedButNotVerified_returns0x0004 (new;
uses markAccessDocumentFinalizedForTesting without
markAccessDocumentVerified)
- auth1_bitmap_adProvisionedAndVerified_returns0x0005 (the previous
M2A.3 case, now correctly gated on the verified flag)
Tests run: 147, Failures: 0, Errors: 3 (pre-existing GCM only).
ed316102bf