Root cause of the permanent stuck-at-challenge symptom: a stale
appAttestKeyId in Keychain (Secure Enclave key invalidated by an app
reinstall or signing change) makes generateAssertion fail every time
with DCError code 2 (invalidInput). Only NetworkError 403 was clearing
the stored key, so this local rejection was never recovered from -
every guest-authed call kept retrying the same broken key forever.
Catch DCError here too and fall through to fresh attestation.
6187dc1907