evidencectl: bound the Evidence child's stderr while it runs, not after capture

[jeremi]

Context

check_with_evidence and render_discovery_description in crates/registry-evidencectl/src/authoring.rs run the operator-selected evidence binary with Command::output(), which reads the child's whole stderr into memory before child_diagnostic truncates it to MAX_CHILD_DIAGNOSTIC_BYTES (512 bytes) and strips control sequences.

The bound therefore applies only to what evidencectl prints, not to what it buffers. A misbehaving, wrapped, or looping child that writes stderr without end grows evidencectl's memory until the child exits.

The binary is one the operator selects and installs, so this is a robustness gap in a trusted-tool path, not a trust-boundary defect. It was raised by the automated reviewer on PR #851 (#851 (comment)) and postponed from that PR.

Proposed change

• Spawn the child with piped stdout and stderr, read each through a bounded reader (Read::take of the diagnostic bound plus one byte, then drain and discard the rest so the child does not block on a full pipe), then wait for the exit status.
• Keep child_diagnostic as the single place that sanitizes and truncates what is printed.
• Both call sites share the helper, so the change lives in one function.

Tests

• A fake evidence binary (a shell script or a test-only subcommand) that writes several megabytes to stderr and then exits non-zero: the diagnostic evidencectl prints stays within the bound and the command completes.
• The existing CSI/C0 stripping and truncation tests keep passing.