feat: Align CTAP status values with CTAP 2.2

[DennisDyallo]

Summary

• Add CTAP 2.2 status mappings for PUAT required and PIN token expired.
• Clarify CTAP 2.1 plus CTAP 2.2 status coverage in docs/comments.

Verification

• dotnet toolchain.cs -- test --project Fido2 --filter "FullyQualifiedName~CtapExceptionTests"
• Read-only review: no findings

[DennisDyallo]

@claude remove this, we dont need backwards compat:

Keep obsolete PUVATH alias for source compatibility.

[claude]

Claude finished @DennisDyallo's task in 1m 12s —— View job

---

Removed PuvathRequired backwards compat alias

• Read CtapStatus.cs to locate PuvathRequired
• Search for all usages across the codebase
• Remove the alias and its test
• Commit and push

Changes made:

• src/Fido2/src/Ctap/CtapStatus.cs — removed the [Obsolete] PuvathRequired = PuatRequired alias entry
• src/Fido2/tests/Yubico.YubiKit.Fido2.UnitTests/CtapExceptionTests.cs — removed PuvathRequired_ObsoleteAlias_MapsToPuatRequired test (no longer needed)

The only remaining mention of PuvathRequired is in Plans/audit-gate-2.md (a plan doc, not production code) — left untouched.

[Copilot]

Pull request overview

This PR updates the SDK’s CTAP status handling to align with CTAP 2.2 by adding the newer PUAT-required and PIN-token-expired status codes, then wiring those through exception messaging and WebAuthn error mapping.

Changes:

• Update CtapStatus/CtapException to use PuatRequired (0x36) and add PinTokenExpired (0x38) with descriptive exception messages.
• Update WebAuthn client and PreviewSign extension to map the new statuses to NotAllowed.
• Add unit tests to assert CTAP 2.2 numeric values and message text; adjust integration test wording/expectations to reference PuatRequired.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/WebAuthn/src/Extensions/PreviewSign/PreviewSignErrors.cs	Map CTAP 2.2 statuses (PuatRequired, PinTokenExpired) to PreviewSign client errors.
src/WebAuthn/src/Client/WebAuthnClient.cs	Treat PuatRequired/PinTokenExpired as NotAllowed in CTAP→WebAuthn error mapping.
src/Fido2/tests/Yubico.YubiKit.Fido2.UnitTests/CtapExceptionTests.cs	Add assertions for CTAP 2.2 status byte values and exception message text.
src/Fido2/tests/Yubico.YubiKit.Fido2.IntegrationTests/FidoMakeCredentialTests.cs	Update test name/docs/expectations to reference PuatRequired (and related firmware variants).
src/Fido2/src/Ctap/CtapStatus.cs	Introduce CTAP 2.2 statuses and update documentation links/comments.
src/Fido2/src/Ctap/CtapException.cs	Add CTAP 2.2 status message mappings for exception construction.