feat(bazel): capture & forward Bazel stderr (phase 1)

[gregmagolan]

Today every Bazel invocation in AXL tasks (ctx.bazel.build / ctx.bazel.test, both via bazel_runner.axl) spawns the Bazel child with cmd.stderr(Stdio::inherit()), so its output reaches the terminal untouched and we can't pre-process it.

This adds an opt-in capture → process → forward path for the child's stderr: the runtime captures it, runs each record through an extensible pipeline, and forwards the survivors to the real stderr. Phase 1 forwards verbatim — the goal here is to get capture mode, ordering, flushing/snappiness, memory bounds, and lifecycle correct. It's the foundation for follow-ups: output cleanup (dedup repeated lines + count), pattern-matched hooks, and hung/locked-up-server detection.

Off by default. With no opt-in, stderr stays Stdio::inherit() and behavior is byte-for-byte unchanged.

How it works

• Conditional capture mode. When BazelTrait.capture_output is set, bazel_runner.axl builds a processor and decouples --isatty from stdout to match the captured fd:
  • destination stderr is a TTY → allocate a PTY so Bazel keeps its live curses UI (--isatty=1); forward the master bytes near-verbatim.
  • otherwise (CI, redirected) → a plain pipe + --curses=no --isatty=0, so Bazel emits clean newline-terminated lines (the tractable substrate for the deferred dedup/match work).
• Reader/forwarder thread (stream/output.rs, modeled on the BES stream): splits records on \n and \r (so the \r-driven progress UI stays live), flushes once per read, runs a LineProcessor pipeline (pass-through in phase 1 — the seam where dedup/matchers plug in), and writes to the real stderr. Single producer→consumer with a blocking write, so back-pressure is automatic — deliberately not the unbounded Broadcaster used for structured BES events. Handles Linux EIO-as-EOF, caps the in-flight line buffer, and maintains a last_activity atomic for the deferred stall watchdog.
• Lifecycle: the OutputStream is joined in Build::wait after the child is reaped, so all forwarded stderr is flushed before the task prints its terminal summary. The PTY slave is dropped right after spawn so the master observes EOF (the classic PTY-hang pitfall).

Deferred to follow-ups (room left, not wired): dedup+count, output_match hooks, and the kill/unhealthy decision — which per design will live in the existing bazel_attempt_end hook.

---

Changes are visible to end-users: no

• Searched for relevant documentation and updated as needed: yes (Starlark API docstrings on ctx.bazel.build/.test, bazel.output.processor, and the BazelTrait.capture_output field)
• Breaking change (forces users to change their own code or config): no
• Suggested release notes appear below: no

Test plan

• New test cases added — 7 OutputStream unit tests (record splitting, CR/LF, partial-line flush, carry cap, processor drop) and 2 real-subprocess round-trips through the full capture machinery for both pipe and PTY (these prove no hang at EOF).
• Covered by existing test cases — 771 AXL unit tests pass; no-opt-in build verified unchanged.
• Manual testing:
  • Pipe path: ASPECT_CAPTURE_TEST=1 aspect build //examples/deliverable:py_deliverable 2>err.log (via a temp config gate, reverted) — Bazel's stderr forwarded to the file, exit 0, no hang; confirmed --curses=no --isatty=0 via ASPECT_DEBUG=1.
  • PTY path: same under script -q (real TTY) — confirmed --isatty=1, output forwarded through the PTY master, exit 0, no hang.