Your main assumption that key size is directly related to the format of the keys, parameters or output size does not hold.
Normally the attacker would only have access to a public EC key, which is (usually) not 256 bit, but a point on the curve. This point consists of two coordinate values prefixed with an indicator (compressed or uncompressed points).
Usually a key - public or private - would be encoded using some kind of ASN.1 DER structure (PKCS#8/X9.62). So the format of either keys is usually much larger than the key size. This is different from e.g. symmetric ciphers where the keys just consist of random bits.
ECDSA signatures - just like ECDSA public keys - consist of two components with the (approximate) size of the ECC key size. Usually the signature is ASN.1 DER encoded as well. So it would be pretty easy to distinguish it from a AES256 encrypted block.
All that said, EC private keys (parameter S) are normally fully randomized. And as the output of SHA256 should also look perfectly random to an attacker, there would be nothing to distinguish between the two.
However, if the attacker has access to the key or hash, you would expect that they would also have access to some plaintext/ciphertext combination to verify which algorithm was used.