http ota: spec-correct retry timer, TLV and APDU edges (v2.2.12)

Audit against GP v2.2 Am.B 4.7 / TS 102 226 / GP Card Spec 11.11 found the
retry waiting delay encoded as plain hex instead of the TP-SCTS semi-octet
order required by TS 102 223 8.38 -> TS 23.040 9.1.2.3 (1 min must be 10,
20 s must be 02); the builder now encodes semi-octets, clamps 0-59 / 0-99 and
pads the 2-byte counter. Odd-length hex is padded instead of producing
fractional BER lengths; empty 83/84/89 sub-TLVs are omitted (lengths are 1-n
per Tables 4-3/4-5/4-8..10) and an empty trigger becomes 81 00; a store
payload above a short APDU is chained as P1.b8=0 STORE DATA blocks (P2 =
block number). Connection presets fixed: device identities 82, alpha 05,
command details 81, bearer 35/03; the A5 store tag and the 'B0,00=unlimited'
counter hint are marked unverified (not in the pinned spec). Docs:
UICC_SPECS.md 9.6.5 example annotated 2 s, findings 10-minute timer corrected
to 1 minute; help updated. SW cache otaman-v177.

docs/scp81-findings.md

@@ -51,7 +51,9 @@ continuation GET STATUS (P2=02 with the last AID as search criterion).
 - `80CA008500` (GET DATA HTTP administration parameters) **works** and returns
   the SD's stored OTA configuration: `8A 09 "localhost"`, `8B 14 <agent id>`,
   `8C 01 "/"` (stored URI), `85 14 <PSK identity>`, `86 07 00 01 25 03 00 10 00`
-  (retry counter 1, timer **10 minutes**), `02 40 01` (KVN/KID), APN-ish
+  (retry counter 1, timer **1 minute** — the `25 03` h:m:s fields are TP-SCTS
+  semi-octets, TS 23.040 §9.1.2.3: low nibble = most significant digit, so
+  `10` = `01` min), `02 40 01` (KVN/KID), APN-ish
   `C7 04 03 47 50 42`, destination `BE 05 21 5B D5 05 02` = 91.213.5.2.
 - `80F28002/80F24002/80F21002 ...4F0000` return `6985` through the reader when
   the ISD is not the current DF; the reference platform sends
@@ -64,7 +66,8 @@ continuation GET STATUS (P2=02 with the last AID as search criterion).
   `0A` channel status.
 - A Location status event re-triggers the OTA session only while the last
   session is incomplete; after a clean session end the card waits for a push.
-- The SD stores a 10-minute retry timer (`25 03 00 10 00`).
+- The SD stores a 1-minute retry timer (`25 03 00 10 00`; timer fields are
+  TP-SCTS semi-octets per TS 102 223 §8.38 / TS 23.040 §9.1.2.3).
 
 ## Confirmed rules (with evidence)