diagnostic: add null guard to wl_proxy_add_listener + bind tracing

- libwayland: fprintf+abort if wl_proxy_add_listener called with NULL proxy.
  Prints caller address via __builtin_return_address(0) to identify
  which Qt6 function passes the null proxy.
- compositor: eprintln each wl_registry_bind to show which globals
  Qt6 binds before crashing.
- Next boot will definitively identify the crash source.

local/recipes/wayland/libwayland/source/src/wayland-client.c

@@ -646,10 +646,15 @@ wl_proxy_destroy(struct wl_proxy *proxy)
  * \memberof wl_proxy
  */
 WL_EXPORT int
-wl_proxy_add_listener(struct wl_proxy *proxy,
-		      void (**implementation)(void), void *data)
-{
-	if (proxy->flags & WL_PROXY_FLAG_WRAPPER)
+ wl_proxy_add_listener(struct wl_proxy *proxy,
+ 		      void (**implementation)(void), void *data)
+ {
++	if (!proxy) {
++		fprintf(stderr, "FATAL: wl_proxy_add_listener(NULL) — caller=%p impl=%p\n",
++		        __builtin_return_address(0), (void*)implementation);
++		abort();
++	}
+ 	if (proxy->flags & WL_PROXY_FLAG_WRAPPER)
 		wl_abort("Proxy %p is a wrapper\n", proxy);
 
 	if (proxy->object.implementation || proxy->dispatcher) {

local/recipes/wayland/redbear-compositor/source/src/main.rs

@@ -728,6 +728,11 @@ impl Compositor {
                         let _version = read_u32(payload, &mut cursor)?;
                         let new_id = read_u32(payload, &mut cursor)?;
 
+                        eprintln!(
+                            "redbear-compositor: client {} binds '{}' -> id {}",
+                            client_id, iface, new_id
+                        );
+
                         let mut clients = self.clients.lock().unwrap();
                         if let Some(client) = clients.get_mut(&client_id) {
                             let type_id = match iface.as_str() {