chore: sync fork with upstream nfcim/flutter_nfc_kit develop (3.6.2)

[dobby-coder]

Summary

Rebase this fork onto nfcim/flutter_nfc_kit:develop (3.6.2). The fork's only diverging commit (the merge of #1 — Android poll fix) is already in upstream as nfcim/flutter_nfc_kit#228, so there is no fork-specific work left to preserve.

This PR was generated as part of the encryption4all/dobby#105 audit findings (L1 — fork 7 commits behind, missing 3.6.2).

What this brings in

Upstream commit	Description
b860c91	androidReaderModeFlags (feat)
88a5725	Merge PR nfcim#228 — same android-poll-fix already in this fork as PR #1
0e679b9 0163bfd 2c930fb 9a4038d	PR nfcim#225 + formatting
531ec8e	bump to 3.6.2

git diff origin/develop..upstream/develop --stat:

 CHANGELOG.md                                       |   5 +
 README.md                                          |  23 +++
 .../im/nfc/flutter_nfc_kit/FlutterNfcKitPlugin.kt  |  16 +-
 example/pubspec.lock                               |   2 +-
 lib/flutter_nfc_kit.dart                           | 202 +++++++++++++--------
 pubspec.yaml                                       |   2 +-
 6 files changed, 171 insertions(+), 79 deletions(-)

Consumer impact

privacybydesign/irmamobile (yivi_app, yivi_core, yivi_fdroid) and privacybydesign/vcmrtd pin via git URL to this fork's default branch, so they will pick up 3.6.2 after this merges.

Suggested merge style

Use "Create a merge commit" (default). The fork's existing merge commit 6af23fe will remain in history, harmless. Optionally, after merging, force-update develop to match nfcim:develop directly to drop the now-redundant 6af23fe.

Out of scope (tracked upstream)

The other audit findings (M1 WebUSB magic comparison; L2 APDU log level; L3 release-mode type guards; L5 workflow permissions: hardening) are upstream code, and fixing them in this fork would re-introduce divergence. They belong on nfcim/flutter_nfc_kit; the bot lacks write access to file them there.

Test plan

• CI passes (test.yml, example-app.yml)
• Manual smoke test from a downstream consumer (irmamobile / vcmrtd) optional — content is identical to upstream 3.6.2

Part of encryption4all/dobby#105 (L1, L4 partial — tracker stays open for M1/L2/L3/L5 upstream).

---

🤖 Filed by Dobby on behalf of the encryption4all audit routine.

[dobby-coder]

Self-review fix: updated the PR body to replace Closes part of encryption4all/dobby#105 (L1, L4 partial). with Part of encryption4all/dobby#105 (...).

Per the pr-close-issue-keywords rule: PRs that only partially address an issue should use Part of #N or Refs #N deliberately, not a closing keyword. Merging this fork-sync resolves only L1 and L4 of the audit; M1/L2/L3/L5 remain open upstream, so the tracker must stay open. The earlier "Closes part of …" form mixed a closing keyword with a qualifier that GitHub's parser does not reliably handle and was ambiguous about whether merge should auto-close the tracker.

No code changes — the diff is unchanged (a clean fast-forward of nfcim/flutter_nfc_kit:develop 3.6.2).