fix(docker): clean up exec output handling and remove app:list workaround

[joshtrichards]

Resolves #954

This PR refactors Docker exec output handling so stdout and stderr are split at the low-level exec layer, while keeping the higher-level runExec helper simple for existing callers.

Why

runExec previously merged stdout and stderr into a single stream. That made command output harder to reason about, and forced runOcc to work around mixed output when parsing structured responses like occ app:list --output json.

The underlying demux fix has since been accepted upstream and is available in the current dockerode version (which we've since already upgraded to), so we can now separate the streams properly.

What changed

• add a low-level runExecRaw helper that returns { stdout, stderr }
• keep runExec as a thin wrapper that returns stdout only
• log stderr separately when verbose is enabled
• remove the old app:list parsing workaround in runOcc
• parse occ app:list --output json directly from clean stdout

Compatibility

This keeps the common runExec(...): Promise<string> calling pattern intact for existing callers, while making stderr available through runExecRaw for cases that need it.

The main behavioral change is that runExec now returns stdout only, instead of merged stdout/stderr output.