feat(certgen): add enforcement tags to native DER encoder and teeResponses cache

Extend Rust native cert gen with software-enforced attestation tags
(CALLER_NONCE, ACTIVE_DATETIME, ORIGINATION_EXPIRE_DATETIME,
USAGE_EXPIRE_DATETIME, USAGE_COUNT_LIMIT, UNLOCKED_DEVICE_REQUIRED)
and make NO_AUTH_REQUIRED conditional in teeEnforced. Fixes F5/F6
test failures where these tags were missing from NativeCertGen path.

Add teeResponses cache so PATCH mode keys patched in onPostTransact
return consistent attestation via getKeyEntry. Without this, getKeyEntry
fell through to real keystore2, returning unpatched metadata.

Remove dead Rust enums (KeyPurpose, SecurityLevel, VerifiedBootState)
that were never referenced by the DER encoder.

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt

@@ -149,6 +149,10 @@ class KeyMintSecurityLevelInterceptor(
                     metadata.authorizations =
                         InterceptorUtils.patchAuthorizations(metadata.authorizations, callingUid)
                     patchedChains[keyId] = newChain
+                    teeResponses[keyId] = KeyEntryResponse().apply {
+                        this.metadata = metadata
+                        iSecurityLevel = original
+                    }
                     SystemLogger.debug("Cached patched certificate chain for imported key $keyId.")
                     return InterceptorUtils.createTypedObjectReply(metadata)
                 }
@@ -212,6 +216,10 @@ class KeyMintSecurityLevelInterceptor(
                 // We must clean up cached generated keys before storing the patched chain
                 cleanupKeyData(keyId)
                 patchedChains[keyId] = newChain
+                teeResponses[keyId] = KeyEntryResponse().apply {
+                    this.metadata = metadata
+                    iSecurityLevel = original
+                }
                 SystemLogger.debug(
                     "Cached patched certificate chain for $keyId. (${key.alias} [${key.domain}, ${key.nspace}])"
                 )
@@ -641,6 +649,13 @@ class KeyMintSecurityLevelInterceptor(
                 idManufacturer = params.manufacturer,
                 idModel = params.model,
                 idSecondImei = if (attestVersion >= 300) params.secondImei else null,
+                activeDatetime = params.activeDateTime?.time ?: -1L,
+                originationExpireDatetime = params.originationExpireDateTime?.time ?: -1L,
+                usageExpireDatetime = params.usageExpireDateTime?.time ?: -1L,
+                usageCountLimit = params.usageCountLimit ?: -1,
+                callerNonce = params.callerNonce == true,
+                unlockedDeviceRequired = params.unlockedDeviceRequired == true,
+                noAuthRequired = params.noAuthRequired != false,
             )
 
             val resultBytes = NativeCertGen.generateAttestedKeyPair(config) ?: return null
@@ -861,6 +876,7 @@ class KeyMintSecurityLevelInterceptor(
         }
 
         val generatedKeys = ConcurrentHashMap<KeyIdentifier, GeneratedKeyInfo>()
+        val teeResponses = ConcurrentHashMap<KeyIdentifier, KeyEntryResponse>()
         val patchedChains = ConcurrentHashMap<KeyIdentifier, Array<Certificate>>()
         val attestationKeys: MutableSet<KeyIdentifier> = ConcurrentHashMap.newKeySet()
         val importedKeys: MutableSet<KeyIdentifier> = ConcurrentHashMap.newKeySet()
@@ -868,7 +884,7 @@ class KeyMintSecurityLevelInterceptor(
         private val interceptedOperations = ConcurrentHashMap<IBinder, OperationInterceptor>()
 
         fun getGeneratedKeyResponse(keyId: KeyIdentifier): KeyEntryResponse? =
-            generatedKeys[keyId]?.response
+            generatedKeys[keyId]?.response ?: teeResponses[keyId]
 
         fun findGeneratedKeyByKeyId(callingUid: Int, nspace: Long?): GeneratedKeyInfo? {
             if (nspace == null || nspace == 0L) return null
@@ -887,6 +903,7 @@ class KeyMintSecurityLevelInterceptor(
                 SystemLogger.debug("Remove generated key ${keyId}")
                 GeneratedKeyPersistence.delete(keyId)
             }
+            teeResponses.remove(keyId)
             if (patchedChains.remove(keyId) != null) {
                 SystemLogger.debug("Remove patched chain for ${keyId}")
             }
@@ -917,6 +934,7 @@ class KeyMintSecurityLevelInterceptor(
             val count = generatedKeys.size
             val reasonMessage = reason?.let { " due to $it" } ?: ""
             generatedKeys.clear()
+            teeResponses.clear()
             patchedChains.clear()
             attestationKeys.clear()
             importedKeys.clear()

app/src/main/java/org/matrix/TEESimulator/pki/NativeCertGen.kt

@@ -45,6 +45,13 @@ data class CertGenConfig(
     val idManufacturer: ByteArray?,
     val idModel: ByteArray?,
     val idSecondImei: ByteArray?,
+    val activeDatetime: Long = -1L,
+    val originationExpireDatetime: Long = -1L,
+    val usageExpireDatetime: Long = -1L,
+    val usageCountLimit: Int = -1,
+    val callerNonce: Boolean = false,
+    val unlockedDeviceRequired: Boolean = false,
+    val noAuthRequired: Boolean = true,
 )
 
 object NativeCertGen {