Clarify Secure Channel authenticate precondition: SD must be selected by caller

[Copilot]

SecureChannelSession.authenticate() and SCP protocol docs described an internal SELECT step that no longer exists in protocol implementations. This mismatch obscured a real call-site precondition and contributed to cold-session failures when authentication starts before ISD selection.

• What changed

  • Updated SecureChannelSession.authenticate() javadoc to remove the SELECT step from the documented flow.
  • Added explicit precondition text: the Security Domain must already be selected; caller must issue plain SELECT.
  • Applied the same precondition/documentation alignment to:
    • Scp03Protocol.authenticate() (removed stale SELECT step from flow docs)
    • Scp02Protocol.authenticate() (added method-level javadoc with the same precondition)

• Scope

  • Documentation-only change; no runtime logic or protocol behavior changed.
  • Keeps current responsibility split (selection at call sites such as install flow), while making the contract explicit for non-install call paths.

/**
 * <p><strong>Precondition:</strong> the card's Security Domain identified by
 * {@link SecureChannelProfile#securityDomainAid()} must already be selected before calling
 * this method. Callers are responsible for issuing the plain SELECT command.
 */

• Fixes SecureChannelSession.authenticate() javadoc claims it SELECTs the Security Domain, but the protocols no longer do (regression risk: 6882 on cold sessions) #4