wrapKey

Return the 32-byte wrapping key, creating and persisting it on first use. Raise an error if secure storage is unavailable — the caller must then use the unsealed path, which makes no rollback claim, rather than fall back to an unprotected key. A store that exists but cannot be reached yet (a Keychain before first unlock, a Keystore that needs the user) throws StoreUnavailable, which the client passes through as that kind, so the app retries after the unlock; anything else is State.