Fix unbounded stderr_buffer leak; make Daemon stderr reliable

[nyo16]

Summary

Fixes two findings from a performance review of the OTP I/O paths.

1. Unbounded stderr_buffer memory leak

In the default :consume stderr mode, NetRunner.Process drained the child's
stderr pipe (correct — keeps the child from blocking on a full pipe) but
prepended every chunk to state.stderr_buffer, a list that was never read
anywhere in lib/ (verified write-only). For long-running processes —
especially NetRunner.Daemon — this grew the GenServer heap without bound,
retaining data nothing could use.

NetRunner.Stream.AbnormalExit already defined a :stderr field and a
message/1 that formats it, but was never raised with stderr populated — the
orphaned consumer half of a half-built diagnostic feature.

Fix: retain only a bounded tail of stderr.

• Keep the most-recent :stderr_tail_bytes bytes (default 8192) as a single
  binary; drain-and-drop the rest. Stats still count every byte — only
  retention is capped.
• New accessor NetRunner.Process.stderr_tail/1 surfaces it (useful for
  diagnosing why a command failed).
• New :stderr_tail_bytes option, validated as a non-negative integer (0
  disables retention while still draining).

2. Daemon stderr-pipe race

NetRunner.Daemon ran its own stderr drain task and left the default
:consume internal consumer on, so the two raced the same FD and on_output
received an arbitrary subset of stderr. Daemon.init/1 now forces
stderr: :disabled so its drain task is the sole reader and on_output gets
the full stream, in order.

Deliberately out of scope

• stream!/2 / run/2 halt semantics are unchanged (no new raise on
  nonzero exit). AbnormalExit is kept defined-but-unraised as a future opt-in,
  to avoid a breaking change.
• The select-handler micro-optimization (retry only the FD that fired) was
  deferred — low impact at current usage (0–2 parked reads).

Notes

• No C / shepherd / protocol changes — entirely BEAM-side. PTY mode unaffected.
• The stderr tail is raw bytes and may begin mid-character; treat it as
  diagnostic text, not guaranteed-valid UTF-8 (documented).

Test plan

• mix format --check-formatted, mix compile --warnings-as-errors,
  mix credo --strict, mix dialyzer — all clean.
• mix test — 150 passed (added test/stderr_tail_test.exs: tail bound,
  custom cap, cap=0, leak guard (O(1) retention vs O(n) throughput), option
  validation, :disabled read path, and Daemon on_output full-stream).