log: capture sandbox stderr and keep a durable on-disk copy

[Meirtz]

Summary

Delivers the two observability gaps inherited from #122's /log intent, additively — the structured LogRecord bridge with ack/replay stays; this only adds what that bridge cannot see.

• fd-2 capture (log: sandbox fd-2 (stderr) output never reaches the host /log namespace #138): fd 2 becomes a capture pipe like fd 1. Child-process stderr, C-extension writes, and direct sys.stderr prints replay on the host /log namespace under agentix.sandbox.stderr (same chunked, deadlock-free drain as stdout). The root console handler is repointed at the saved REAL stderr, so stdlib records are not delivered twice and a worker diagnostic emitted against a broken outbound pipe cannot self-amplify.
• Durable in-sandbox log (log: no durable in-sandbox log artifact — output that outlives the connection is unrecoverable #139): every bridged record and captured line is also appended to a size-bounded (64 MiB × 1 rotation) $AGENTIX_LOG_DIR/sandbox-<worker-id>.log (default /tmp/agentix; empty disables), so output that outlives the connection — or the host — has a post-mortem artifact. Best-effort: a write failure detaches the handler rather than reporting into its own capture pipe, and announces the detach on /log so a truncated file is distinguishable from a quiet sandbox.

Review

Three-lens adversarial review (fd lifecycle / log-routing topology / durability promises) with refuters per finding — 5 distinct defects confirmed with empirical repros, all fixed in the second commit:

1. Unlocked handler.emit() from the drain path racing a threaded rollover permanently detached the file → handler.handle() (locked, still bypasses the logger tree).
2. Worker crash tracebacks vanished into the reader-less capture pipe (zero bytes anywhere, exit misreported as 120) → main() restores fd 2 from the saved real stderr on the way out; verified by spawning a worker with an injected read_frame crash — full traceback now reaches the container stderr, exit 1.
3. The shared default path let two workers race one file's rotation (rename fails → permanent detach) → per-worker filename; every spawn has a fresh id.
4. Outbound-write failures logged a traceback per frame, self-sustaining against a broken pipe and flooding the durable file during the death window → first failure at exception level, repeats at debug.
5. Silent permanent detach was indistinguishable from a quiet sandbox → announced on /log (the wire is not the broken resource).

Known standing constraint (pre-existing in kind for the fd-1 capture, now shared by fd 2, documented in-code): a remote async def that blocks the event loop while its child spews ≥64 KiB into a captured fd wedges both sides — async callables must not block the loop; sync callables run in threads and are unaffected.

Testing

• 4 new behavior tests (TDD, red→green): sys.stderr print → host record; child-process stderr → host record; stdlib records NOT re-captured as raw stderr; durable file contains records + both stdio streams.
• pytest -q tests plugins: 607 passed, 6 deselected; ruff clean; pyright 0 errors at 3.11 and 3.13.

Closes #138. Closes #139.

🤖 Generated with Claude Code