[akasakariko]

Summary

• Send stdout and stderr to the same output file instead of reading their pipes sequentially
• Preserve command start and exit error wrapping, including output collected before nonzero exits
• Add portable subprocess regression coverage for empty and mixed output, large individual streams, nonzero exits, start failures and canceled contexts

Reproduction

• Confirmed on unmodified master at 77a79bf on macOS ARM64
• A subprocess with empty stdout and 160835 bytes on stderr deadlocked until its 3-second deadline, then was killed with only 65536 bytes collected
• The large stderr, mixed large output and nonzero exit regression cases all timed out before the fix
• The original reproduction now completes before the deadline and preserves all 160835 bytes

Verification

• Race-enabled diagnostic package tests pass, including three repeated regression runs
• make test lint passes with default race detection, all 49 packages with tests pass and lint reports zero issues
• make fmt-check cloudflared passes
• The first full run was stopped after the existing ICMP concurrency test stalled, an isolated rerun and the full rerun both passed without changing ingress code

Fixes #1783