v1.9.4: decode_step/hunt byte-replay tests + hunt EOF guard

- tests: TestDecodeStep drives decode_step() with a scripted byte queue
  (read/peek/consume stubbed over _replay + the queue; the re-align/PPS/
  ATR/annotation sinks stubbed): 'CX'/'EX' exchanges frame and emit clean,
  0x5F frames as a command (it was always eaten by the idle-noise gate
  before v1.9.3), the 0x61 text-byte boundary is a one-byte suspicious-CLA
  discard, the invalid-INS re-frame recovers a shifted SELECT, 0xFE still
  takes the idle-noise path.
- tests: TestAtrHuntDetect drives handle_atr(): 0xC4 0xA4 / 0xC4 0x89
  hand the header to DATA via _replay, CLA 0x00 stays excluded, an invalid
  INS does not hand off.
- pd.py: the hunt command-detect guards peek_byte() returning None (a
  capture ending right after a plausible CLA byte raised TypeError, seen
  only by decode()'s crash protection);
  test_eof_after_plausible_cla_is_clean pins the clean return.
- AGENTS v1.9.4 section; baseline regenerated (version + test listing;
  compare_baseline: IDENTICAL); 95/95 unit tests.

pd.py

@@ -28,7 +28,7 @@ from .gsmtap_stream import (GsmtapStreamSender,
     GSMTAP_SIM_RST_EVENT, GSMTAP_SIM_VCC_EVENT,
     GSMTAP_FLAG_BAD_FCS)
 
-VERSION = '1.9.3'
+VERSION = '1.9.4'
 
 
 
@@ -1766,7 +1766,10 @@ class Decoder(srd.Decoder):
             # on noise like the 0x00 0x1E seen in the live test.
             if plausible_cla(byte) and byte != 0x00:
                 nxt = self.peek_byte()
-                if plausible_ins(nxt):
+                # nxt is None at end-of-capture: keep hunting (the read
+                # below returns None and the hunt ends cleanly) instead of
+                # calling plausible_ins(None), which raises TypeError.
+                if nxt is not None and plausible_ins(nxt):
                     self._replay.appendleft(byte)
                     self.hasT0 = True
                     self.hasT1 = False