Preserve UTF-8 in piped machine environment values

[ymichael]

Human comments

What was wrong

The machine-environment CLI decoded every stdin chunk separately. A multibyte UTF-8 character split across pipe chunks was therefore replaced with invalid-character markers before the value was saved, even though the command reported success. This follows up on the machine-environment support added in PR #3274.

What changed

Collect stdin as bounded byte buffers and decode UTF-8 once after EOF. The existing 65,536-byte limit is still enforced on raw bytes before removing one trailing newline. Empty input, CRLF handling, secret masking, validation, and preservation of unrelated variables are unchanged.

How you verified

• Added regressions for deliberately split UTF-8, empty input, CRLF, repeated newlines, exact ASCII and multibyte byte limits, and over-limit rejection. The split-character and multibyte-boundary cases fail before the fix and pass afterward.
• pnpm exec turbo run test typecheck build --filter=@bb/cli --force: 59 files and 607 tests passed; build and typecheck passed.
• Exact two-file formatting and git diff --check origin/main...HEAD passed.
• Ran the built CLI against the worktree test server and its encrypted disk SQLite database. Split café, €, and 🌍 values were stored exactly; byte limits, masking, and unrelated-value preservation passed. Temporary variables were removed.

AGENT GENERATED