feat(logging): UID-keyed attestation dossier

Add a debug-only per-UID diagnostic plane gated on BuildConfig.DEBUG.
For apps in target.txt it records every keystore interaction and the
forged attestation it produces to teesim-uid-<uid>.log: decoded cert
chain (FORGE and PATCH paths), key params, keybox, and prop sources,
with the calling UID threaded through the C++ binder hook and Rust
certgen. Release builds stay silent (R8 strips the write plane and the
runtime gate short-circuits). Adds --clear-logs to package.sh.

scripts/package.sh

@@ -27,6 +27,7 @@ REBOOT=false
 VERIFY=false
 BUILD_RUST=false
 CLEAR_KEYS=false
+CLEAR_LOGS=false
 TRACE=false
 ROOT_PROVIDER="ksu"
 
@@ -52,6 +53,7 @@ Deploy options:
   --deploy           Push ZIP to device and install
   --reboot           Reboot device after install
   --clear-keys       Clear persistent_keys before deploy
+  --clear-logs       Clear per-UID diagnostic logs before deploy
   --verify           Run logcat verification after deploy
   --root PROVIDER    Root provider: ksu (default), magisk, apatch
 
@@ -73,6 +75,7 @@ while [[ $# -gt 0 ]]; do
         --verify)     VERIFY=true; shift ;;
         --rust)       BUILD_RUST=true; shift ;;
         --clear-keys) CLEAR_KEYS=true; shift ;;
+        --clear-logs) CLEAR_LOGS=true; shift ;;
         -v|--verbose) TRACE=true; shift ;;
         --root)       ROOT_PROVIDER="$2"; shift 2 ;;
         --help|-h)    usage ;;
@@ -153,6 +156,11 @@ deploy_zip() {
         adb shell "rm -rf /data/adb/tricky_store/persistent_keys/*" 2>/dev/null || true
     fi
 
+    if [[ "$CLEAR_LOGS" == true ]]; then
+        bold "==> Clearing per-UID diagnostic logs"
+        adb shell "rm -f /data/adb/tricky_store/logs/teesim-uid-*" 2>/dev/null || true
+    fi
+
     bold "==> Deploying $name"
     adb push "$zip" /data/local/tmp/module.zip
     adb shell "su -c '$INSTALL_CMD /data/local/tmp/module.zip'"