fix(iso15): correct transport flags + append CRC host-side (scan/rdbl/wrbl)

ISO15_READ_RESPONSE was 0x10 but the firmware bit is 0x20 (0x10 is HIGH_SPEED, which pm3py lacked), so scan/rdbl/wrbl sent flags 0x19 with READ_RESPONSE never set -> firmware never listened and replied empty. The ARM firmware also ignores ISO15_APPEND_CRC (the C client adds the CRC host-side via AddCrc15), so pm3py's CRC-less frames were never answered by a real tag.

Fix flag values to match firmware include/iso15.h, add crc15 (CRC-16/X-25), and route all iso15 commands through _iso15_payload (appends CRC, sends CONNECT|HIGH_SPEED|READ_RESPONSE=0x31). Payload now byte-matches the C client getUID. Pre-existing bug, independent of the firmware rebase.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_crc.py

@@ -1,4 +1,4 @@
-from pm3py.core.protocol import crc16_a
+from pm3py.core.protocol import crc16_a, crc15, crc15_bytes
 
 def test_crc16_a_empty():
     assert crc16_a(b"") == 0x6363  # init 0xC6C6 reflected = 0x6363
@@ -15,3 +15,20 @@ def test_crc16_a_ping_preamble():
     crc = crc16_a(preamble)
     assert isinstance(crc, int)
     assert 0 <= crc <= 0xFFFF
+
+
+def test_crc15_known_vector():
+    # ISO15693 / NFC Type 5 CRC == CRC-16/X-25; standard check string -> 0x906E
+    assert crc15(b"123456789") == 0x906E
+
+def test_crc15_residue():
+    # Appending crc15 (LSB-first) then re-running the raw X-25 loop over the full
+    # frame yields the X-25 residue 0xF0B8 — the property firmware CheckCrc15 uses.
+    data = bytes([0x26, 0x01, 0x00])
+    frame = data + crc15_bytes(data)
+    crc = 0xFFFF
+    for byte in frame:
+        crc ^= byte
+        for _ in range(8):
+            crc = (crc >> 1) ^ 0x8408 if (crc & 1) else (crc >> 1)
+    assert crc == 0xF0B8