chore(callgrind): log underflow resets and instrument_state transitions

Two diagnostic logs to attribute every (cxt==0) push_cxt event to its
root cause:

1. handleUnderflow: prints the BB address, fn name, obj, and skip flag
   for the fn that's about to be force-pushed after a call-stack
   underflow. Tells us whether leaks are driven by signals, longjmp,
   or shadow-stack quality.

2. set_instrument_state: logs every ON/OFF transition with the cxt
   and fn-stack depth at that moment. Distinguishes 'fresh start with
   no cxt' from 'stop/start cycle that preserved cxt'.

Together with the existing 'push_cxt FORCED' log, these let us bucket
the leaked frames in real Python runs by their root cause.

Author: not-matthias

callgrind/bbcc.c

@@ -513,6 +513,11 @@ static void handleUnderflow(BB* bb)
   CLG_(current_fn_stack).top--;
   CLG_(current_state).cxt = 0;
   caller = CLG_(get_fn_node)(bb);
+  VG_(message)(Vg_UserMsg,
+               "underflow reset: cxt=0, BB=%#lx, fn-about-to-push='%s' "
+               "obj='%s' skip=%d\n",
+               bb_addr(bb), caller->name,
+               caller->file->obj->name, caller->skip);
   CLG_(push_cxt)( caller );
 
   if (!seen_before) {

callgrind/main.c

@@ -1453,6 +1453,13 @@ void CLG_(set_instrument_state)(const HChar* reason, Bool state)
 	     reason, state ? "ON" : "OFF");
     return;
   }
+  VG_(message)(Vg_UserMsg,
+               "instrument_state -> %s (reason='%s', cxt=%p, "
+               "fn_stack_depth=%ld)\n",
+               state ? "ON" : "OFF", reason,
+               (void*)CLG_(current_state).cxt,
+               (long)(CLG_(current_fn_stack).top -
+                      CLG_(current_fn_stack).bottom));
   CLG_(instrument_state) = state;
   CLG_DEBUG(2, "%s: Switching instrumentation %s ...\n",
 	   reason, state ? "ON" : "OFF");