Tools: preserve bounded no-GIL corpus failure diagnostics

Parents: #478, #491 Related: #617

Problem

tools/nogil-corpus-gate.ts discards each threads-test child stdout/stderr and records only [case, elapsed]. Fresh ReleaseSafe CI therefore reports that cve/mc-val-multislot-clone.js and semantics/oom-one-thread.js regressed, but not whether either exited on a semantic assertion, safety trap, panic, timeout, or signal-shaped host failure. This blocks exact diagnosis of security and OOM regressions and makes distinct failures look identical.

Required implementation

• Preserve exit status, timeout state, and a bounded tail of stdout/stderr for newly regressing cases.
• Prefix and escape every emitted diagnostic line so corpus-controlled output cannot inject GitHub workflow commands or terminal controls.
• Keep the current baseline comparison and one-execution-per-case behavior exact.
• Add deterministic self-tests for truncation, stdout/stderr labeling, control escaping, empty output, and workflow-command neutralization.
• Run that self-test in an existing Home-enabled required tooling leg.

No-workaround rules

• No reruns, hidden retries, case skips, deadline changes, unbounded logs, swallowed failures, or test-source edits.

Acceptance

• A synthetic failing child produces bounded, safe, source-labeled diagnostics with exact exit/timeout metadata.
• Existing pass/known/improved/regression classification stays unchanged.
• Dependency/tooling audits and workflow-generated platform evidence pass.

The engine defects exposed by those diagnostics remain separate children.

Implemented by d08585a5. Newly regressing cases now retain exact exit/timeout metadata plus independent 4 Ki-character stdout and stderr tails within one 8 Ki-character bound. CR/control bytes are escaped and every physical line is source-prefixed, so child output cannot begin a GitHub workflow command. The self-test covers labels, empty streams, both truncation paths, command injection, control escaping, and exit-vs-timeout rendering; it passes locally and is wired into the required thread tooling leg. Keeping this open for the fresh CI confirmation.

Implemented across d08585a5 and 2ea0f25d. The completed pre-fix Debug and ReleaseSafe shard-3 jobs reproduced why tail-only output was insufficient: the panic header was omitted while only recursive stack frames survived. The follow-up retains labelled head and tail excerpts inside the same combined 8,192-character cap; its deterministic self-test covers sentinels, workflow syntax, control escaping, empty streams, and a 505-character bounded fixture. Fresh validation: CI run 32369900898.

Fresh Linux ReleaseSafe CI confirms the bounded diagnostic path is working on a real crash: run 32369900898, no-GIL shard 3/4 retained the exact panic header and the debugAssertWtf8 -> finishManagedString -> allocManagedString stack for cve/mc-val-multislot-clone.js while keeping the shard summary readable.

That newly actionable engine failure is now tracked separately as #651; this issue remains scoped to diagnostic retention and its gate coverage.

Closing after the production Linux corpus gate demonstrated the intended failure path in run 32369900898: it retained the exact panic header and managed-string stack while keeping the shard report readable. The exposed engine defect is tracked independently in #651; no diagnostic workaround or baseline exemption was introduced.