Fix #829: route detach --purge diagnostics to stderr under --json

[HypForge]

Refs #829

What changed

hyp client detach <client|all> --purge --json used to drop every line the purge produced, including failures such as "the local CA could not be removed". This follows Phil's recorded decision on the issue (2026-10-06):

• Under --json, the purge lines now go to stderr.
• stdout is still the per-client NDJSON, byte for byte. There is no trailing purge object and no new field.
• The "Skipped --purge" line (when a client refuses to detach) was already a stderr line, but the same json gate silenced it. It now prints in JSON mode too.
• Text mode, dry-run (no cleanup) and exit codes are unchanged.

Tests

The new tests in test/core/detach-stops-recording.test.js pin process.platform to linux, so the purge never reaches the real keychain or launchd. Each one checks that every stdout line parses as JSON and no stderr line does, so a consumer that merges the two streams can't misread a diagnostic as a record.

• Success: stderr names the CA removal. stdout is byte-identical to the same run without --purge (after normalizing the stage temp root).
• Partial failure: a directory sits where the CA key belongs, so the unlink fails. stderr carries the failure line, and stdout and the exit code match the run without --purge.
• all: one record per client, and the purge runs once.
• Dry-run: the CA is left in place and nothing about a purge is printed.
• Refused detach with --json: stderr says the purge was skipped.

Against master's clients.js:

• The four non-dry-run tests fail, and only on their stderr assertions.
• The success and partial-failure tests compare stdout before the stderr check, and that comparison passes. So stdout is the same before and after the fix.
• The dry-run test passes there too, since master already does nothing on a dry run.

Checks: npm test has 8658 passing and 0 failing (3 not run). npm run typecheck is clean.

Review notes

• Server-suite gate: not triggered. No new CLI command, no contract.js change, and no MCP codec, tool schema or error-code change.
• CPU and memory: no new work. The same bounded list of lines is written to a different stream.
• Not changed: the other historical items on Preserve proxy-cleanup diagnostics on stderr when client detach uses JSON output #829 are already handled in Phil's disposition comment, so they're left alone.
• Per that comment, Preserve proxy-cleanup diagnostics on stderr when client detach uses JSON output #829 is closed once this lands.

🤖 Generated with Claude Code