377ce297f1
Flip DIAGNOSTICS_ENABLED static-final boolean from true to false so the production j3r452 CAP rejects INS_DIAG_HMAC/ECDH/ECDSA_SIGN/GCM (0xD0-0xD3) with SW_INS_NOT_SUPPORTED. javac's constant-folding elides the diagnostic dispatch branch in process(); the JC converter keeps the unreachable processDiag method body and DIAG_KEY_32 etc. arrays so the byte saving is modest (the JC converter does not do whole-program DCE on private fields/methods). CAP size (j3r452): before 101008 B -> after 100989 B (delta -19 B, 0.02% reduction). This is smaller than the original ~2-3 KB estimate in the plan -- the estimate assumed javac/JC-converter DCE would prune the diag arrays and methods, but neither does. Reclaiming the ~2 KB diag-vector + diag-method footprint requires extracting the diag code to a separate class and excluding it from the production profile, which is out of scope for M2 (file-level surgery, not a constant flip). The runtime SW_INS_NOT_SUPPORTED rejection still delivers the security objective: no diag opcodes execute on a prod build. For CI/bench builds that need the diag opcodes, the constant can be locally flipped to true (no test changes required; no diag tests in the suite reference INS_DIAG_*). Regression: 147 tests, 0 failures, 3 pre-existing GCM errors (no new failures). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>