fix(sandbox): split stderr from stdout in _parse_logs (#11629)

[mrveiss]

Closes #11629

Thinking Path

_parse_logs always returned empty stderr. The issue suggested demuxing frame headers, but docker-py's non-tty, non-streaming container.logs() already strips the 8-byte headers and joins payloads (_multiplexed_buffer_helper) — the combined bytes are irreversibly merged before we ever see them, so header-parsing in _parse_logs can never work. Root cause fix: request the streams separately from the daemon (server-side filtering — same mechanism the #11613 broker path already uses). Sandbox containers are created without tty, so per-stream filtering is valid.

What Changed

• secure_sandbox_executor.py: _execute_container_with_timeout fetches logs(stdout=True, stderr=False) and logs(stdout=False, stderr=True); _parse_logs(stdout_raw, stderr_raw) decodes each via new _decode_log_stream and returns a real (stdout, stderr) pair; broker path _collect_broker_results reads stderr from element 1 instead of the old lump-into-stdout quirk.
• Tests: monkeypatch lambdas updated to the new signature; new test_parse_logs_splits_stdout_and_stderr and test_execute_container_with_timeout_fetches_streams_separately (asserts a combined fetch is never made).

Verification

• tests/unit/chat_workflow/test_code_exec.py: 69 passed (agent run and independent re-run identical). py_compile clean.
• test_codeexec_docker_smoke.py 4 skipped — Docker-daemon-gated, deferred to the on-box followup(validation): on-box Docker stdio-broker smoke before enabling AUTOBOT_CODEEXEC_ENABLED #11596 smoke (code-exec feature remains flag-off).

Model Used

Claude Fable 5 (subagent: general-purpose)

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!