Instrumentation-only. Logs entry (primitive class, callingUid, input size) and throwable propagation (class, SSE error code, message, stack top) in both SoftwareOperation.updateAad and SoftwareOperationBinder.updateAad. Intended to distinguish F1 hypotheses H1 (binder swallows SSE) vs H3 (AIDL signature drift) once duck's probe key is routed through our simulator instead of the real TEE.