Preserve guest stderr on normal browser exits

[brandonpayton]

Summary

• keep browser-only nonzero-exit diagnostics in the browser console
• stop forwarding those host diagnostics into the guest process stderr stream
• cover a real status-7 process exit with a Chromium BrowserKernel regression test

Root cause

The browser worker logged a normal nonzero process exit with console.warn and also posted the same host diagnostic as a guest stderr event. Node does not alter guest stderr for normal nonzero exits. Commands such as false, grep no-match, and shell children that intentionally return a nonzero status therefore had browser-only, non-POSIX stderr output.

The diagnostic remains available in the browser console. Only the guest-visible stderr injection is removed.

Validation

On the history-only stack over #889 (bcd704a6aa7678f8ef326cb7f65003db971b8d02):

• ./scripts/dev-shell.sh npm --prefix host run typecheck
• ./scripts/dev-shell.sh bash -c "cd apps/browser-demos && npx playwright test --list test/browser-nonzero-exit-stderr.spec.ts --project=chromium" (1 test listed)
• git range-diff 31e77f56b..ab819240c origin/main..HEAD (semantic commit unchanged)
• git diff --check origin/main...HEAD

The pre-rebase exact ABI 18 Chromium probe using the staged Homebrew Dash artifact returned exitCode=7, empty stdout/stderr/combined output, and one browser-console diagnostic. That is historical semantic evidence.

Hosted attempt 3 proved the repaired public ABI 18 ledger materializes all 66 required packages, then exposed a test-fixture bug before Kandelo started: the new spec hardcoded a developer-local local-binaries Dash path while CI correctly materializes fetched package bytes under binaries. The spec now uses the authoritative resolveBinary("programs/dash.wasm") contract. A fetch-only resolver run with no local Dash selected the fetched symlink and read 459,958 bytes; Playwright compiled the corrected spec and listed its single Chromium test. Hosted CI will run the behavior test on exact head ed3f2afae64d260d906f7d712b21d8eb558998a8. git range-diff reports both #875 commits patch-identical; the only new parent is #889's separately reviewed test-readiness correction.

The complete browser suite was not run locally. App-wide tsc --noEmit was attempted but remains red on existing unrelated app/host typing debt; it reported no error in this spec. Attempt 3's Vitest failure is the known pre-#889 teardown readiness race and is unrelated to this change. No ABI or guest artifact changes.

[brandonpayton]

CI note: the failing test-gate-prepare did not reach this PRs Playwright regression. The separate Browser demo smoke workflow passed. Fetch-only materialization rejected four ABI-16 composite packages because the durable release index.toml currently points at older keys (lamp 9f777974, node-vfs 5ca2294d, shell 2f4b693f, wordpress 6c52e8a5) while current main computes the newer #863-promoted keys (64104909, 7618c9c6, f7dccdb9, 76133d30). Both generations of archives are present in the release; the index was updated later than the newer assets. I am leaving this host-only patch unchanged and will rerun the gate after #867 publishes the ABI-18 baseline.