chore(debug): move diagnostic dumps to subfolder

The debug-only .bin dumps wrote loose into /data/local/tmp, cluttering a
directory shared with every other tool. Route both writers through a
shared DIAGNOSTIC_DIR (/data/local/tmp/teesim) with mkdir-on-write, and
extend the release purge to sweep the new folder plus any loose leftovers
from older debug installs.

app/src/main/java/org/matrix/TEESimulator/App.kt

@@ -12,6 +12,7 @@ import org.bouncycastle.jce.provider.BouncyCastleProvider
 import org.matrix.TEESimulator.config.BootStateManager
 import org.matrix.TEESimulator.config.ConfigurationManager
 import org.matrix.TEESimulator.interception.keystore.AbstractKeystoreInterceptor
+import org.matrix.TEESimulator.interception.keystore.InterceptorUtils
 import org.matrix.TEESimulator.interception.keystore.Keystore2Interceptor
 import org.matrix.TEESimulator.interception.keystore.KeystoreInterceptor
 import org.matrix.TEESimulator.logging.SystemLogger
@@ -80,6 +81,10 @@ object App {
      */
     private fun purgeDebugDiagnostics() {
         if (SystemLogger.isDebugBuild) return
+        purgeStale(File(InterceptorUtils.DIAGNOSTIC_DIR), InterceptorUtils.DIAGNOSTIC_DIR) { name ->
+            name.startsWith("teesim-") && name.endsWith(".bin")
+        }
+        // Older debug installs wrote the dumps loose in /data/local/tmp; sweep those too.
         purgeStale(File("/data/local/tmp"), "/data/local/tmp") { name ->
             name.startsWith("teesim-") && name.endsWith(".bin")
         }
@@ -88,7 +93,9 @@ object App {
         }
     }
 
-    /** Deletes matching files in [dir], logging a single once-per-boot audit line if any existed. */
+    /**
+     * Deletes matching files in [dir], logging a single once-per-boot audit line if any existed.
+     */
     private fun purgeStale(dir: File, label: String, matches: (String) -> Boolean) {
         val stale = dir.listFiles { _, name -> matches(name) } ?: return
         if (stale.isEmpty()) return

app/src/main/java/org/matrix/TEESimulator/interception/keystore/InterceptorUtils.kt

@@ -17,6 +17,13 @@ data class KeyIdentifier(val uid: Int, val alias: String)
 /** A collection of utility functions to support binder interception. */
 object InterceptorUtils {
 
+    /**
+     * Dedicated subfolder for the debug-only diagnostic `.bin` dumps. Keeping them out of the
+     * world-readable `/data/local/tmp` root means they no longer litter a directory shared with
+     * every other tool, and the release purge can sweep the whole folder in one shot.
+     */
+    const val DIAGNOSTIC_DIR = "/data/local/tmp/teesim"
+
     private const val EX_SERVICE_SPECIFIC = -8
 
     private fun synthesizeSseMessage(errorCode: Int): String =
@@ -128,8 +135,8 @@ object InterceptorUtils {
             val savedPos = parcel.dataPosition()
             val wire = parcel.marshall()
             parcel.setDataPosition(savedPos)
-            val path = "/data/local/tmp/teesim-$diagnosticTag.bin"
+            val path = "$DIAGNOSTIC_DIR/teesim-$diagnosticTag.bin"
-            runCatching { java.io.File(path).writeBytes(wire) }
+            runCatching { java.io.File(path).apply { parentFile?.mkdirs() }.writeBytes(wire) }
             SystemLogger.debug("[$diagnosticTag] reply len=${wire.size} path=$path")
         }
         return BinderInterceptor.TransactionResult.OverrideReply(parcel)

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt

@@ -531,8 +531,8 @@ class KeyMintSecurityLevelInterceptor(
             val req = data.marshall()
             data.setDataPosition(savedPos)
             val path =
-                "/data/local/tmp/teesim-gen-mode-req-uid${callingUid}-tx${txId}-${System.nanoTime()}.bin"
+                "${InterceptorUtils.DIAGNOSTIC_DIR}/teesim-gen-mode-req-uid${callingUid}-tx${txId}-${System.nanoTime()}.bin"
-            runCatching { java.io.File(path).writeBytes(req) }
+            runCatching { java.io.File(path).apply { parentFile?.mkdirs() }.writeBytes(req) }
             SystemLogger.debug(
                 "[gen-mode-req] uid=$callingUid txId=$txId len=${req.size} path=$path"
             )