[codex] fix: surface Codex app-server exit diagnostics

[StiensWout]

Summary

• Capture a bounded 4 KiB tail of codex app-server child stderr while continuing to drain stderr for process health.
• Redact secret-shaped stderr before it enters CodexAppServerProcessExitedError, provider status text, or persisted provider status snapshots.
• Wait for process exit plus a bounded stderr drain opportunity before snapshotting exit diagnostics, and fix exact-limit stderr tails so they are not marked truncated.
• Add regression coverage for redaction, exact-limit truncation, and multi-chunk shutdown stderr.

Root cause

T3 Code drained child process stderr to avoid blocking protocol responses, but the exit diagnostic path reused that raw stderr tail directly in the process-exited error message. It also snapshotted stderr before awaiting the process exit status, so late stderr chunks could be missed, and the tail helper treated an exact-limit first chunk as truncated even when no bytes were omitted.

Impact

Windows Codex startup failures can still show actionable recent stderr, but secret-shaped values are redacted before the message can flow through provider status or the provider status cache. Shutdown diagnostics now include stderr captured through the process exit path more reliably, and exact-limit stderr tails no longer show a misleading truncation marker.

Validation

• PATH="$HOME/.vite-plus/bin:$PATH" vp test packages/effect-codex-app-server/src/client.test.ts packages/effect-codex-app-server/src/_internal/stdio.test.ts
• PATH="$HOME/.vite-plus/bin:$PATH" vp check
• PATH="$HOME/.vite-plus/bin:$PATH" vp run typecheck

vp check reports the repository's existing 20 unrelated warnings and no errors.

Refs pingdotgg#2486