keystore2 replaces a key when generateKey reuses an alias. Mirror that: drop any cached chain for the alias so a later getKeyEntry serves the current key, not a stale FORGE from a prior generation (an attest-key-mode leaf cached, then re-generated without an attest key).