Don't swallow stderr in gen_protos_docker

[dandavison]

This change allowed me to see the stderr (my docker storage was full).

---

Note

Low Risk
Local proto-generation helper only; no runtime or production behavior changes.

Overview
docker build in gen_protos_docker.py no longer hides stderr. The subprocess call still pipes stdout so the image ID can be read, but replaces capture_output=True with stdout=subprocess.PIPE only.

When the build fails (e.g. disk full), Docker’s error output now appears in the terminal instead of being swallowed.

^{Reviewed by Cursor Bugbot for commit 0ba1da8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[dandavison]

I don't have permissions to merge this btw.