fix(module): detect diag.sh by file not exit code

The release build is meant to nuke any debug NDJSON directory on
install, but the sweep never ran. customize.sh keyed the debug vs
release decision on unzip's exit code:

  if unzip -qqjo "$ZIPFILE" "diag.sh" ...; then ...

Info-ZIP returns 11 when the entry is absent, but the busybox/toybox
unzip in the Magisk/KSU install environment exits 0, so on a release
ZIP (which correctly omits diag.sh) the branch was wrongly taken and
the rm -rf in else never fired.

Detect presence by the extracted file instead: run unzip, then test
[ -f "$MODPATH/diag.sh" ]. Robust to any unzip implementation.

module/customize.sh

@@ -79,11 +79,15 @@ chmod 755 "$MODPATH/supervisor"
 # Debug builds carry diag.sh (the diagnostic plane); release builds do not. Extract it when
 # present; otherwise sweep any external-storage diagnostics a prior debug install left behind,
 # since the release keystore domain has no grant to remove them itself.
-if unzip -qqjo "$ZIPFILE" "diag.sh" -d "$MODPATH" 2>/dev/null; then
+# Detect presence by the extracted FILE, not unzip's exit code: the busybox/toybox unzip in
+# the install environment exits 0 even when the entry is absent, so the sweep never ran.
+unzip -qqjo "$ZIPFILE" "diag.sh" -d "$MODPATH" 2>/dev/null
+if [ -f "$MODPATH/diag.sh" ]; then
   chmod 644 "$MODPATH/diag.sh"
   ui_print "- Debug diagnostic plane enabled"
 else
   rm -rf /data/media/0/TEESimulator /data/local/tmp/teesim
+  ui_print "- Release build: swept stale diagnostics"
 fi
 
 # --- Configuration Files ---