Hi Jan,
A5/1 works, which means that your auth keys in the SIM and subscriber database match.
In the CM Service Request, your MS indicates that it is capable of A5/3. (In the Classmark 2)
I see that you only have one Location Updating with A5/1. It should work to switch to A5/3 on-the-fly, but just for curiosity, you could try to detach and re-attach the phone after switching to A5/3.
You write that you are using osmo-nitb. Does the problem persist if you use osmo-bsc + osmo-msc + osmo-hlr instead? See: https://osmocom.org/projects/cellular-infrastructure/wiki/Osmocom_Network_In...
Other than that I can't see anything wrong with anything.
If you switch back and forth between A5/3 and /1, do the results remain stable? So it's not your SDR coincidentally clock-unsyncing in the wrong moment by coincidence?
Seems curious that recently there have been other questions about auth / ciph not working for specific osmo-bts-trx variants. There is a faint possibility that one thing or other doesn't get encoded/decoded right??
~N