feat(logging): per-UID NDJSON on external storage

Move debug diagnostics off /data/local/tmp/teesim to
/data/media/0/TEESimulator (visible at /sdcard/TEESimulator), so users
can pull them without a root explorer. The logging code runs in the
keystore SELinux domain, so a debug-only media_rw_data_file grant plus
a debug-only diag.sh fragment gate the plane: diag.sh's presence is the
signal service.sh (setup) and action.sh (export) test. customize.sh
extracts diag.sh on debug installs or sweeps the dir on release, since
the release keystore domain cannot remove it itself.

Replace the per-call .bin parcel dumps (a fresh undecodable file per
generateKey) with one NDJSON record per event on the UID's own file,
carrying decoded fields plus the raw parcel as base64 for the offline
parsers. computeIfAbsent makes per-UID writer creation atomic.

app/build.gradle.kts

@@ -202,6 +202,7 @@ androidComponents {
                 val sourceModuleDir = rootProject.projectDir.resolve("module")
                 from(sourceModuleDir) {
                     exclude("module.prop") // Exclude the template file.
+                    exclude("diag.sh") // Debug-only diagnostic plane; included for debug below.
                 }
 
                 // Copy and filter the module.prop template separately.
@@ -214,8 +215,21 @@ androidComponents {
                     )
                 }
 
+                if (isDebug) {
+                    from(sourceModuleDir) { include("diag.sh") }
+                }
+
                 // The destination for all the above 'from' operations.
                 into(tempModuleDir)
+
+                if (isDebug) {
+                    doLast {
+                        // Debug-only: grant the keystore domain external-storage access; diag.sh
+                        // (shipped only in debug) carries the shell side of the diagnostic plane.
+                        tempModuleDir.get().asFile.resolve("sepolicy.rule")
+                            .appendText("\nallow keystore media_rw_data_file { dir file } *\n")
+                    }
+                }
             }
 
         // Task 2: Zip the prepared files from the temporary directory.