fix: close stdin on streaming Port paths

[joshrotenberg]

Summary

• Fix Port-based streaming (Exec.stream/2, ExecResume.stream/2) hanging indefinitely against codex-cli ≥ 0.118 because the Port inherited stdin from the parent and Codex reads stdin at startup.
• Extract the shell-wrap-and-close-stdin mechanism from Command.run_with_closed_stdin into a shared Command.shell_cmd_args/3 helper so execute and streaming paths share one implementation.
• Streaming opts out of the 2>&1 stderr merge that the execute path uses, so stderr flows to the parent's stderr without contaminating NDJSON on stdout.

Closes #37. Complements #34 which fixed the same root cause in command.ex (the non-streaming execute path) but didn't touch the streaming paths.

Test plan

• mix test — 217 tests pass, no regressions
• Live verification against codex-cli 0.119.0:

  Calling Exec.stream/2 ...
  Stream completed in 13094ms with 4 events.
  Event types: ["thread.started", "turn.started", "item.completed", "turn.completed"]
  SUCCESS: saw turn.completed
  

  Previously this call hung until the internal after 300_000 safety timeout fired with zero events.
• The Reading additional input from stdin... message from Codex no longer appears, confirming stdin is actually closed.

Background

Discovered while building a GenAgent backend adapter on top of this package. The GenAgent Codex backend currently uses the non-streaming exec_json path (which was already fixed by #34), so this fix doesn't unblock anything immediately for that consumer — but any future streaming consumer would have hit the same wall. Getting the streaming path into the same state as execute makes the package's surface consistent.

There is a sibling issue on claude_wrapper_ex (#42) with the same latent root cause — the Claude CLI doesn't currently trigger it, but the code path is structurally identical. Fix PR to follow there.