gid 60 was never a decision -- it was the ENROLL token's timeout field being
read as a gid, then made self-consistent. Keeping it readable alongside gid =
uid would be a second code path, a second group to reason about, and a
migration to eventually retire, all to avoid re-enrolling one finger on one dev
phone. Re-enrol it instead.