fix(cli): write exec stderr events to stderr in interactive mode

[andrewwhitecdw]

Summary

In interactive openshell exec, stderr payloads from the sandbox were written to stdout because the Stderr arm of the event loop was a verbatim copy of the Stdout arm (stdout.lock()). The non-interactive exec path in the same file handles the identical event with stderr.lock(). This broke shell redirection (e.g. openshell exec ... 2>err.txt) and piping of stdout in interactive mode.

This PR supersedes #2407, which was auto-closed by the vouch-check workflow before I was vouched.

Related Issue

N/A — small copy-paste fix found during code review.

Changes

• Bind stderr in the interactive exec event loop and lock it in the Stderr arm, matching the non-interactive path

Testing

• mise run pre-commit passes (mise unavailable in this environment; ran equivalent cargo fmt + cargo clippy -p openshell-cli --all-targets — clean)
• Unit tests added/updated (event loop requires a live gRPC stream; no existing test seam for this path)
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[andrewwhitecdw]

I have read the DCO document and I hereby sign the DCO.

[github-actions]

Label test:e2e applied, but pull-request/2447 does not exist yet. A maintainer needs to comment /ok to test 6f44826cd6f4513a431468bfb71c0374694f08d6 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[johntmyers]

/ok to test 6f44826

[johntmyers]

gator-agent

PR Review Status

Validation: This is a project-valid, concentrated CLI correctness fix. It restores interactive sandbox exec stderr routing to match the established non-interactive path and supersedes the author’s vouch-closed PR #2407.
Head SHA: 6f44826cd6f4513a431468bfb71c0374694f08d6

Review findings:

• No blocking findings remain. A PTY-backed stream-separation regression test would be useful when the harness supports it, but the missing seam does not block this minimal fix.

Docs: Not needed because this restores standard stdout/stderr semantics rather than introducing a new command, flag, or workflow.

E2E: Applied test:e2e because the change affects CLI handling of sandbox exec events over the gateway, and authorized the current mirror with /ok to test 6f44826cd6f4513a431468bfb71c0374694f08d6.

Next state: gator:watch-pipeline