The run command in bats-core has the ability to keep stderr-related output into separate variables:
Use --separate-stderr to split stdout and stderr into $output/$stderr and ${lines[@]}/${stderr_lines[@]}
as per https://bats-core.readthedocs.io/en/latest/writing-tests.html#run-test-other-commands
Should we have assertion helpers that apply to stderr only?