Bound mutation log capture and streamline error summaries

[vwall]

Summary

Long mutation-command logs previously accumulated in unbounded stdout/stderr buffers, even while streamed. Commands whose output is only diagnostic now opt into a 64 KiB tail per stream. Verbose writers still receive all output; retained results carry truncation flags and failure summaries explicitly mark omitted output.

Failure formatting now scans backward for the final ten nonempty lines and limits line prefixes without allocating a rune slice for an entire long line.

Closes #7.

Capture policy

Bounded capture is selected at individual calls for Homebrew install/upgrade/tap, Git clone, shell execution, defaults writes, system/security/login-shell mutations, SSH key generation, and ASDF plugin add/update.

Complete capture remains the default. All inventory/status reads, SSH public-key extraction, and ASDF installs remain complete because callers parse their output. In particular, ASDF installation still searches the full log for version-not-found guidance; bounding those logs would require a separate streaming parser. Custom runner implementations are unchanged.

Evidence

Local real-subprocess benchmarks, three iterations per case (not production guarantees):

Approximate output per stream	Full capture allocations	Bounded capture allocations
64 KiB	677 KB	470 KB
8 MiB	79.7 MB	469 KB

The cap applies independently to stdout and stderr, including a single very long line. Unicode cut boundaries are handled without corrupting otherwise valid UTF-8. Multiline failure formatting allocated about 1.3 KB for both 1 MiB and 64 MiB inputs.

Reproduce with go test ./internal/platform -run '^$' -bench 'BenchmarkExecRunnerOutputCapture|BenchmarkCommandErrorOutputFormatting' -benchmem.

Verification

• make release-check: formatting, full tests, vet, build, distribution smoke
• Targeted platform race tests
• git diff --check
• Real subprocess tests cover large output, long lines, Unicode, mixed streams, complete default capture/verbose streaming, exit failures, cancellation, ring boundaries, and option preservation
• Resource integration tests verify bounded shell errors and complete ASDF parser input
• Built CLI verified JSON truncation diagnostics and complete verbose stdout/stderr
• Independent final review found no actionable regressions

Login-shell smoke coverage was skipped because the host could not report UserShell. Go commands used a writable temporary cache due to sandbox restrictions.

Safety and documentation

• No command arguments, exit semantics, confirmation requirements, or process-cleanup behavior changed.
• Parser input and public-key data remain complete.
• CLI and runtime docs explain the cap, streaming behavior, and parser exclusions.