v1.9.5: T=0 framing — immediate SW, short responses, Le=256

- Decode the first post-header byte as SW1 before the ACK/data decision:
  a case-2 rejection (6A82/6CXX) carries no ACK and used to be read as
  command data, silently consuming the exchange and the next one.
- Short responses (Lr < Le): after the P3-byte read, split the buffer at
  the first plausible SW1 followed by a plausible CLA, replay the tail and
  flag BAD_FCS; previously the SW scan discarded the real SW, merged the
  following exchanges and lost the exchange at EOF.
- P3=0 is Le=256 for an outgoing command: keep the response data (read
  until SW) instead of discarding it, including data bytes equal to INS.
- ~INS ACK: one data byte per ACK via the new helpers; case-4 inline data
  is appended (permissive; ISO 7816-3 §12.2 maps case 4 to GET RESPONSE).
- tests: four TestDecodeStep vectors (immediate SW, short read + split +
  replay, Le=256 data incl. an INS-valued byte); 99/99.
- AGENTS v1.9.5 + T=0 section, README/README_RUS bullets; baseline
  regenerated (xiaomi_mi_a1_coldboot 473 -> 475 APDUs, all else identical);
  compare_baseline: IDENTICAL.

README.md

@@ -230,6 +230,12 @@ filtered from stderr.
   recovering the real command.  Every consumed-but-unemitted byte is
   explicitly logged (`discarded byte 0x…: reason`); idle 0x00/0xFF discards
   are rate-limited, non-idle discards always produce a decoder annotation.
+- A card may finish a command with SW1 SW2 at the first procedure byte
+  (ISO 7816-3 §10.3.3), including a case-2 command with P3 > 0: the SW is
+  framed as the status word, not read as command data.  A response
+  **shorter than Le** is split at the status word and the packet is
+  flagged `BAD_FCS` (the following exchanges stay intact), and `P3=0`
+  (Le=256) response data is kept.
 
 Performance: in native CLK mode the decoder calibrates samples per CLK
 edge once from the ATR's first frame, then advances bit timing with