fix: send the magic UID frames exactly as the tag vendor documents

[L480]

The rfidfriend.com instruction sheet shipped with the magic SLIX-L tags
specifies hf 15 raw -akrc for both UID frames, step 1 = the 0x41 half
(first four UID bytes), step 2 = the 0x40 half. This repo sent -acw,
in the opposite order, and — worse — as two separate pm3 invocations,
which drops the RF field between the halves and can leave the UID
half-written.

• build_uid_frames() now emits -akrc and returns the frames in vendor
  order; the byte mapping was already correct and is unchanged.
• write_uid() and doctor --probe-magic pass both frames to a single
  pm3 session so -k can keep the field up between them.
• HARDWARE.md: correct the flag reference, document the single-session
  requirement, and stop claiming that csetuid without --v2 is
  harmless — the vendor warns against csetuid in any form, and the gen1
  path writes config blocks 0x3E/0x3F.
• CLAUDE.md: add the frame order/session invariant as a hard rule.
• Tests cover the vendor sheet's worked example (E0 04 03 50 12 34 56 78)
  and assert both frames share one session.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_012caw768bkSR8AKYiFQh77W