[ViZiD]

Recognize the firmware USB serial marker when Linux PC/SC uses a driver friendly name without RS-Key or RSK. Preserve exclusive selection for irreversible commands.

Expand the existing reader-selection tests, bump the CLI to 0.3.38, and document discovery in the CLI guide, protocol spec and changelog.

What

[radik@aestas:~/projects/forks/RS-Key]$ lsusb -v -d 1050:0407 | rg iSerial
  iSerial                 3 rs-key-0001

[radik@aestas:~/projects/forks/RS-Key]$ rsk otp lock-page58
no RS-Key PC/SC reader found — check the device is plugged in, CCID is enabled, and the product string still matches. Readers seen: ['Some Vendor CCID (rs-key-0001) 00 00']

# after fix
[radik@aestas:~/projects/forks/RS-Key]$ lsusb -v -d 1050:0407 | rg iSerial
  iSerial                 3 rs-key-0001

[radik@aestas:~/projects/forks/RS-Key]$ rsk otp lock-page58
rescue applet selected ✓  device dsfdsajson2dirasda
This PERMANENTLY locks OTP page 58 away from BOOTSEL / non-secure. No undo.

This is irreversible. Type exactly  dsfdsajson2dirasda  to proceed.

How it was tested

• nix develop -c ./scripts/check.sh passes locally
• On hardware: board = waveshare rp2350 one
• Host-only change (CLI / docs / CI) — no device behavior touched

Checklist

• Device behavior / image changed → config.device_release (bcdDevice) bumped by one (hex)
  in firmware/src/main.rs — host-only (CLI / docs / CI / build) does not (CONTRIBUTING.md)
• Fixes something a downgrade would reopen → flag whether the next release should advance the
  rollback epoch (docs/production.md, stage 3) — a seal-time --rollback call, not a code bump
• New or changed unsafe → justified in docs/unsafe.md
• User-visible behavior → the matching guide under docs/ updated
• New files carry the SPDX header (AGPL-3.0-only)
• Commit messages use the zone prefix style (fido:, piv:, rsk:, docs:, …)