Print the trustlet's rc on every enrol press, and let deploy-dev.sh pass extra flags

A refused enrolment sample is one of two things: an image the algorithm saw and
turned down (rc=0, samples remaining unchanged) or an error the trustlet never
got past (a negative rc). The touch line printed the count and the fid but not
the rc, so a run of twenty-two refusals in a row said nothing about which it was.
It does now.

EXTRA=... on deploy-dev.sh appends daemon flags, so a diagnostic session can
come up with --ta-log without editing the script or the unit by hand.

packaging/deploy-dev.sh

@@ -26,6 +26,7 @@ set -eu
 
 HOST=${1:-fp6usb4}
 CONFIG=${CONFIG:-}    # optional: a fingerprintd.json to install
+EXTRA=${EXTRA:-}      # optional: extra daemon flags, e.g. EXTRA=--ta-log
 SSH="ssh -o ConnectTimeout=8 -o BatchMode=yes $HOST"
 
 cd "$(dirname "$0")/.."
@@ -52,7 +53,8 @@ done
 rm -f /tmp/fingerprintd.new
 echo ">> copied"
 
-$SSH 'set -e
+# EXTRA crosses into the single-quoted remote script as a prefixed assignment.
+$SSH "EXTRA='$EXTRA'; "'set -e
 # Stop before the swap so the new binary is what starts, not the old inode.
 sudo systemctl stop fingerprintd-test 2>/dev/null || true
 sudo mv /tmp/fingerprintd.new /tmp/fingerprintd
@@ -76,7 +78,8 @@ sudo systemctl stop fingerprintd-test 2>/dev/null || true
 sleep 1
 sudo systemd-run --unit=fingerprintd-test --collect \
     /tmp/fingerprintd --daemon --verbose --edge-wake \
-    --sfs-root=/var/lib/fingerprintd/sfs --sfs-writable --rpmb-write >/dev/null
+    --sfs-root=/var/lib/fingerprintd/sfs --sfs-writable --rpmb-write $EXTRA >/dev/null
+[ -z "$EXTRA" ] || echo ">> extra daemon flags: $EXTRA"
 printf ">> daemon starting"
 # Scope the readiness check to THIS invocation. The journal persists across
 # restarts and reboots, so grepping the whole unit history matches the ready