The app was asking for the WordPress.org QR Code to create a new auth code. Thanks to Otto, I was able to get my WordPress.org auth code added to the Authenticator app on my new phone, and then log in to WordPress.org as usual. To reset your WordPress.org 2FA codes , click the “Disable Two-Factor app” button (as shown in the above screenshot of 2FA screen at WP.org). wp.org generates the secret, presents it to you as a QR code, which you then scan with the authenticator app. The authenticator app uses that secret and the current time to generate a new 6 digit string every 30 seconds.