v1.9.0: CLK rate in RST events; v1.9.1: T=0 NULL is not an SW1

v1.9.0 -- CLK frequency in RST events:
- RST events (sub_type 0x10) append the measured CLK frequency when known:
  [direction, level, flags, clk_hz_be32], flags bit 0 = rate present; the
  3-byte form is kept when the rate is not yet measured.  Value is
  samplerate / _samples_per_clock from the existing 16-edge measurement (PPS
  changes F/D, not the CLK rate).  VCC events unchanged.  Backward
  compatible (old consumers read the first two bytes only); consumers can
  compute data_rate = clk_hz x D / F from the ATR/PPS Fi/Di.
- Unit tests for the payload codec; README/README_RUS/AGENTS updated.

v1.9.1 -- T=0 NULL is not an SW1:
- The 'scan for SW1' loops accepted any 0x6X byte, including the NULL
  procedure byte 0x60 (card busy), so 'NULL + real SW1' was mis-framed as
  the status word: the phone traces' SELECT MF came out as ...3f00 6061 —
  real SW1 0x61 eaten as SW2, real SW2 0x29 left on the wire and discarded
  as a suspicious CLA (desync cascade).
- plausible_sw() now accepts 0x61-0x6F and 0x90-0x9F only, per
  ISO 7816-3:2006 10.3.3 Table 11 ('6X' or '9X', EXCEPT '60'; ISO 7816-4
  enforces '60' as an invalid SW1) and UICC_SPECS.md 1.8.  All seven
  SW1-detection sites use plausible_sw(); NULLs met while scanning are
  logged as rate-limited wait extensions (_note_pre_sw) instead of
  suspicious bytes.
- tools/vs_reader.py::_plausible_sw() mirrors the fix; regression vector
  for the 00a40004023f006061 artifact.

Validation: 74/74 unit tests; baseline regenerated and IDENTICAL (the SW
fix is count-neutral -- only the SW bytes change); all 9 example pcaps
regenerated -- vs_reader OK, zero APDUs ending in 60 61, SELECT MF now
61 29 / 61 25.

README.md

@@ -83,7 +83,7 @@ GSMTAP header: version 2, type SIM (0x04), UDP port 4729.
 | 0x01 | ATR | raw ATR bytes |
 | 0x02 | PPS request | raw PPS request bytes |
 | 0x03 | PPS response | raw PPS response bytes |
-| 0x10 | RST event (custom) | `[direction, level, 0x00]` |
+| 0x10 | RST event (custom) | `[direction, level, flags, clk_hz_be32]` — CLK frequency appended when known |
 | 0x11 | VCC event (custom) | `[direction, level, 0x00]` |
 
 Event payload byte semantics:
@@ -96,6 +96,13 @@ Event payload byte semantics:
 (PPS request and response are emitted as separate packets).  0x10/0x11
 are custom extensions not defined in libosmocore's gsmtap.h.
 
+RST events carry the measured CLK frequency when it is known: `flags`
+bit 0 is then set and the frequency follows as a big-endian uint32 in Hz
+(7-byte payload).  When the rate is not yet measured the payload stays
+3 bytes, so consumers that read only the first two bytes are unaffected.
+Combined with the F/D negotiated in the ATR/PPS, the data rate is
+`clk_hz × D / F` bits/s.
+
 Header extensions: flags such as `GSMTAP_FLAG_BAD_FCS` are written into
 the header `res` byte, which official gsmtap.h marks reserved (RFU).
 This carriage is this decoder's own extension (upstream simtrace2-sniff