v3.19.1: the compact-PoR decode guard (applet TAR responses reported as data)

pySim's CompactRemoteResp was applied to every response packet, so a
third-party applet's own TAR response parsed as count=128/SW=0110/data=''
(live 2026-10-04: the alfa-dsa applet's `80 01 10`) - a fabricated status
word and a lost response.

_decode_por now takes the plaintext command script's length (cmd_len): the
compact structure's command count cannot exceed it (TS 102 226 5.1.2
Table 5.1 - each command needs at least one byte), so a larger count is
classified `response_type: 'raw'`, the secured data becomes
`decoded.last_response_data` (a por.data check matches it) and no SW is
decoded; `secured_data` is exposed in every case.

Callers pass cmd_len where they know the plaintext: the test runner's scp80
step (None for a pre-built packet; carried in ctx['last_scp80'] for the
submit-PoR path), /api/send-ota (both paths), the RAM step sender and the
counter probe; a caller without it keeps the previous parse.

Docs: test-scripts.md and api.md describe the raw fallback.
Tests: 821 frontend + 729 Python; sw cache simple-v390.

docs/test-scripts.md

@@ -284,7 +284,12 @@ SHORT MESSAGE is decoded with that step's keyset, SPI and counter.  `status`
 is the decoded response status name (`por_ok`, `cntr_low`,
 `rc_cc_ds_failed`, …; `ok` is accepted for `por_ok`); `sw` is the R-APDU
 status word and `data` the R-APDU response data (exact/mask) - both come from
-the decoded response (scripting `AB`/`AF`/compact forms).  A PoR split over
+the decoded response (scripting `AB`/`AF`/compact forms).  An applet's **own
+TAR** answers with its application-defined bytes: when the data cannot be the
+compact remote response (its command count exceeds the command script that
+was sent), the whole secured data is reported as `data` and no `sw` is
+decoded - assert such a response with `data` (the action's `por` object
+follows the same rule).  A PoR split over
 several SMS parts is accumulated across SEND SHORT MESSAGE expectations: put
 the `por` check on the step that completes the sequence (intermediate steps
 should use `raw` or no PoR check).