refactor: scaffold sniff/, transponders/, reader/, sim/ sub-packages

Phases 2-4 of package refactor. Creates the full directory tree with
__init__.py files per the design doc. Actual code migration from the
sim worktree is a separate effort — models have deep inheritance chains
and auth mixins that need base class extraction first.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/plans/2026-03-18-refactor-progress.md

@@ -33,20 +33,42 @@
 
 ## Phase 2 — Extract `sniff/`
 
-**Status: Deferred — no sniff infrastructure exists yet**
+**Status: Scaffolded — extraction deferred**
 
 `hf_iso15.py` is 94 lines of clean reader commands + thin `sniff()` firmware call. The trace parsing, 15693 decoders, NDEF annotation, and ANSI formatting described in the design doc haven't been written yet. Nothing to extract.
 
-Will revisit when sniff infrastructure is implemented.
+Created `pm3py/sniff/__init__.py` placeholder. Will extract into sub-modules when sniff infrastructure is implemented.
 
 ## Phase 3 — Scaffold `transponders/`
 
-**Status: Not started — models live in sim worktree**
+**Status: Complete (scaffolded)**
 
-Transponder models exist in `.worktrees/sim-framework/` but haven't been merged to master. Scaffold when ready to migrate.
+Created full directory tree per design:
+- `transponders/hf/iso14443a3/nxp/` — MIFARE Classic, Ultralight, NTAG
+- `transponders/hf/iso14443a4/nxp/` — DESFire, NTAG 5
+- `transponders/hf/iso15693/nxp/` — ICODE SLIX2
+- `transponders/hf/iso15693/st/` — ST25TV
+- `transponders/lf/atmel/` — T55xx
+- `transponders/lf/em/` — EM4100, EM4x05
+
+All directories have `__init__.py`. Model migration from sim worktree is a separate effort — the sim framework has ~7.8k LOC with deep inheritance chains (`Transponder` → `Tag15693` → `NxpIcodeTag` → `IcodeSlix2Tag`, etc.) and auth mixins (`NxpPasswordAuth`, `NxpAesAuth`). Base class extraction needs to happen alongside model migration.
 
 ## Phase 4 — Scaffold `reader/` and `sim/`
 
-**Status: Not started**
+**Status: Complete (scaffolded)**
 
-Depends on Phase 3 and sim worktree merge.
+Created directory trees per design:
+- `reader/hf/nxp/` — NXP reader ICs (CLRC663, PN5xx)
+- `reader/hf/st/` — ST reader ICs
+- `reader/lf/`
+- `reader/modes/` — inventory, programming, access control workflows
+- `sim/` — sim session, table compiler, relay (migrate from worktree)
+
+All directories have `__init__.py`. Sim migration (~41 files, 7.8k LOC) is a separate effort.
+
+## Next Steps
+
+- Sniff infrastructure: implement trace parsing, 15693 decoders, NDEF annotation, ANSI formatting in `sniff/`
+- Transponder migration: extract base classes from sim worktree, populate `transponders/` modules
+- Sim migration: move sim session, table compiler, relay into `sim/`
+- Reader modes: implement inventory, programming, access workflows in `reader/modes/`