Support A2540 microphone notifications

[gilwilliams520-hash]

What changed

• Accept the A2540 voice notification signature 04 00 1B 36 00 in addition to the existing A2854 signature 04 00 1B 35 00.
• Add positive parser coverage for both generations and keep an unsupported 0x0037 handle as a negative case.
• Document the generation-specific ATT handles and the shared sequence/length/Opus layout.

The live parser previously hard-coded the A2854 attribute handle 0x0035. A physical A2540 sends the same Opus frame format on attribute handle 0x0036, so otherwise-valid second-generation voice frames were discarded.

How it was verified

• swift test --package-path SiriRemoteCore — 113 tests passed
• cd app && ./build.sh
• cd mic/router && ./build.sh — parser test, monitor-ring test, and router build passed
• cd mic && ./build-test.sh — Opus decode, concealment, buffer, and WAV self-test passed
• Ran it against one real A2540 on macOS 26.5 over Bluetooth
• Screenshotted the UI change

With the Siri button held, remote-microphone audio reached the virtual input and was successfully used for dictation. The A2540 sequence, payload length, and Opus TOC/layout matched the existing A2854 path.

Notes for the reviewer

• Only the sanitized ATT signature is included. No Bluetooth address, serial number, or raw user audio/capture is published.
• This PR is intentionally separate from device detection and UI support so the undocumented microphone protocol can be reviewed independently.