fix(desktop): preserve Runtime Host exit diagnostics

[HuYellow]

Summary

The detached local Runtime Host was launched with ignored stdio, so after its
transport reached EOF Desktop had no process exit code, signal, or Host stderr
to include in the diagnostic report.

This change captures a bounded 4 KiB stderr tail and exit status while
preserving detached-process behavior, associates that evidence only with the
spawned PID selected by the final Host registration, and records a redacted
diagnostic in both the main-process log and a dedicated bounded process-exit
buffer. Copied Desktop diagnostics retain the last four local Host exits even
when repeated transport errors fill the ordinary log buffer and the Host is no
longer available.

Fixes #3333

Verification

• npx biome check <11 changed files>
• npm --workspace @maka/runtime-host run build
• npm --workspace @maka/desktop run build:main
• npm --workspace @maka/runtime-host run typecheck
• npm --workspace @maka/desktop run typecheck
• Targeted Runtime Host tests for selected-PID association and bounded stderr
  exit evidence
• Targeted Desktop tests for secret redaction and preserving exit evidence when
  Runtime Host diagnostics are unavailable

The full Desktop suite was also run on Windows: 955 tests passed, 17 unrelated
existing environment-dependent tests failed, and 7 were skipped. The failures
were Windows symlink EPERM, SQLite cleanup EBUSY, and Rive CLI fixture
failures. All tests added or changed by this PR pass.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex assisted with root-cause analysis,
implementation, regression tests, local verification, and PR drafting. The
contributor will review the final diff and accepts responsibility for the contribution.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Lint, formatting, typechecks, builds, and targeted affected tests pass. The
full Desktop suite has the unrelated Windows failures listed under Verification.

Does this PR entail a change in behavior?

• Yes - described under Summary above
• No

[jackwener]

Automated Codex review on exact head 40ecd476303d230f601119b1fb2a33f6a134e446 found no actionable code issue.

The bug still exists on current main: detached Runtime Host candidates use ignored stdio, so after transport EOF Desktop cannot report the selected child’s exit code, signal, or stderr. This revision keeps the evidence bounded (4 KiB stderr tail and four Desktop exit records), associates it only when the final registration PID matches a process spawned by this election, redacts before logging/persistence, and keeps detached lifecycle handles unreferenced. The startup-failure path still derives from the same exit evidence, and the process map is election-local rather than long-lived.

The required test check is green. The optional Windows package failure is a renderer CDP smoke timeout; a contemporaneous documentation-only PR failed with the same Packaged Maka renderer did not expose CDP signature, while this run’s earlier Windows package/installer smokes passed. I therefore do not attribute that failure to this diff, though a rerun would provide cleaner evidence.

Required conclusions:

1. Optimal for the actual problem: yes.
2. Production code to delete: none identified.
3. Tests to delete/replace: none identified.
4. Deeper refactor: no; launcher exit evidence and Desktop presentation remain at the correct boundary.
5. Ready to merge: no; independent human review is still missing.
6. Residual risk/gaps: rerun the non-required Windows package smoke; exact-head human judgment remains the merge gate.

This changes user-visible diagnostics and detached-process observability, so independent human review is required under CONTRIBUTING.md. No security, licensing, governance, or public-contract effect was identified.