debug: re-add capped SUBST emit logging + enc1 -> m_iPawnHealth (HUD) + m_iHealth

Diagnose whether the per-field bit-copy substitution actually rewrites the value
(only Verify-mode-tested before). enc1 now spoofs the controller m_iPawnHealth
(what the HUD reads) plus pawn m_iHealth. Temporary diagnostics.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>