ci: stream routed command output while retaining exact evidence bytes

[EffortlessSteven]

Problem

ci-record-command retains exact stdout/stderr bytes for routed-Rust evidence, but it buffers child output until the command exits. Long Cargo commands therefore provide no live progress and can consume unnecessary memory even though the retained log bytes are correct.

Target seam

• xtask/src/main.rs: ci-record-command command execution and receipt finalization
• xtask/src/run.rs: child process IO adapter
• xtask/src/tests.rs: byte/order/exit-state controls
• .github/workflows/routed-rust.yml: consumer only if the command interface changes

Acceptance criteria

• Stream child stdout and stderr to the job log while the child is running.
• Retain deterministic evidence bytes for the exact command and preserve the digest contract consumed by ci-child-receipt and ci-routed-rust-result.
• Preserve child exit code, passed/failed/not_run ordering, cancellation behavior, and failure-class semantics.
• Add a discriminator that would fail if output were buffered until process exit.
• Add byte-level controls for interleaved stdout/stderr, non-UTF-8 bytes, partial writes, and a failing child.
• Keep the resulting PR review-forward and independent of routing, cache, runner, or protected-authority changes.

Proof commands

cargo test -p xtask --locked ci_record_command -- --test-threads=1
cargo test -p xtask --locked routed_rust -- --test-threads=1
cargo clippy -p xtask --all-targets --locked -- -D warnings
cargo fmt --all -- --check

Non-goals

• Changing the routed proposition table or required checks.
• Changing cache ownership or branch protection.
• Treating terminal output timing as correctness evidence.

Source truth

• Follow-up from ci: make GitHub-hosted Routed Rust the first-class source route #1657 review.
• docs/CI.md routed-Rust evidence contract.

Risk / rollback

The main risk is reordering or losing bytes while teeing two streams. Keep the existing buffered adapter available until the new byte/order controls pass. Rollback is a revert to buffered capture; that restores current observability without weakening receipt correctness.