fix(agent-backend): keep a bounded stderr tail on failed Agent Turns

[berenddeboer]

When an Agent Backend CLI died with its only explanation on stderr, the
operator never saw it. The originating case was an expired AWS SSO token:
Claude Code exited non-zero in about two seconds, wrote the credential
error only to stderr, emitted no JSONL result, and never tripped the 60s
startup watchdog. runCliTurn had stderr: "ignore", so the text was
discarded and the Cause chain stopped at a bare AgentBackendExitError.

#1056 already surfaces adapter-parsed reasons. This change is the missing
capture path for text that exists only on stderr (#1057).

What changed

• Agent Turns pipe stderr and drain it inside the same raced Effect.all
  as stdout and exitCode, so a piped stream is never left undrained.
• The fold keeps the last 4000 characters (same bound as Install
  Dependencies).
• On non-zero exit, if the adapter supplied no reason, the tail is
  sanitized (ANSI stripped, token-shaped secrets redacted) and then
  truncated to the last 500 characters as AgentBackendExitError.message.
  An adapter-supplied reason still wins.
• A CLI that writes only to stderr still hits the startup watchdog.
  Finalize still tree-kills immediately; the fold cannot block that kill.

Verification

• runCliTurn: stderr-only exit message, adapter precedence, flood plus
  4000-character fold bound, sanitization and a token that straddles the
  500-character cut, finalize timing, stderr-only startup watchdog.
• Implement: a fake CLI that writes only to stderr shows
  AgentBackendExitError 1 — … in extractCauseChain.
• agent-backend tests and the Claude, Codex, Grok, and OpenCode adapter
  suites stayed green.

Limitations

• Silent non-zero exits with empty stderr still have no message (staged
  for Make AgentBackendExitError.message required via expand–contract #1066).
• Fold-fiber leak is prevented by putting the drain in the race, not by
  an Effect child-fiber assertion (not observable after tree-kill).

Closes #1057