buildLegacyEncryptedAuthenticationPayload
abstract suspend fun buildLegacyEncryptedAuthenticationPayload(device: CredLinkDevice, lockSignature: ByteArray, isTimeSync: Boolean, trueTimeManager: ITrueTimeManager): ByteArray?
PKOC step C (phone side): verifies the lock signature, signs the authentication message, and returns the AES-GCM encrypted write payload (IV + ciphertext TLVs).