fix(acp): retain live subprocess stderr

[kywch]

Summary

Captures bounded stderr from subprocess-backed ACP agents throughout their lifetime and persists a redacted tail when transport closes.

Root cause

BenchFlow read stderr only after ACP stdout reached EOF. A protocol-valid empty end_turn can leave stdout open, so diagnostics written to stderr were discarded at normal teardown.

Safety

• 64 KiB stderr tail cap
• redact before rollout artifact and typed transport diagnostic persistence
• close waits at most two seconds for an inherited stderr FD, then cancels the drain

Validation

• uv run python -m pytest tests/test_acp.py tests/test_process.py
• uv run ruff format --check src tests
• uv run ruff check src tests
• git diff --check

Fixes #976.

[Galius5136]

I reproduced the stderr-loss path from #976 locally on WSL using the deterministic fake-ACP regression described in the issue, and compared the merge-base (29c64e7) with the PR head (d769f34). I drove ContainerTransport directly (both with a local subprocess and the real DockerProcess) rather than running a full bench eval run.

On the base, the ACP response completes normally with end_turn, but stderr is not retained and the agent log is not created.

With #980, the ACP response stays unchanged, while the stderr diagnostic is preserved in the agent log. I also verified the same behavior through the real DockerProcess path.

I checked the bounded stderr tail as well: it stays at 65536 bytes, drops the head, and retains the tail. Secret redaction also worked as expected: the diagnostic sentinel was present, REDACTED was present, and the original AIzaSy... token prefix was absent.

Everything behaved as expected on my setup, and I didn't observe any protocol regression or shutdown hang.