fix(tools): keep ix stdout when the command exits non-zero

[KageBinary]

Step 1 of the sequence ix-infrastructure/Ix#539 lays out: the plugins must tolerate a non-zero exit before the CLI starts producing one. That issue names this plugin explicitly as a reason ix locate cannot simply be fixed.

Two commits — the second is what #539 asks for; the first is a bug I hit while testing it and could not leave.

1. fix(runtime): abort timers leaked on the failure path

callRuntime and getRuntime cleared their abort timer only after a successful fetch. When the runtime is unreachable the fetch rejects, so the timer stayed pending for its full 5s — and a pending timer keeps the event loop alive, so the host process hung for five seconds at exit on every call. isRuntimeAvailable never captured its timer at all, leaking on every path including success.

This is the normal case, not an edge case: these tools have a CLI fallback precisely because most machines do not run the Core Runtime.

Measured against an unreachable runtime — the call itself returns in ~20ms, so only the exit is delayed:

	before	after
child process exit	5010 ms	28 ms

Found because it made the tests below time out at bun's 5s default.

2. fix(tools): keep stdout when ix exits non-zero

Bun's $ throws on a non-zero exit and .text() discards stdout with it, so safeRun returned null for any failed command — and ix-docs-tool fell back to a generic "Not found in graph", discarding the diagnostics ix had supplied.

.nothrow() keeps stdout. It returns "" both for a missing binary and for a failure with no output, and both still map to null, so the ix-unavailable path is unchanged.

The tests run in a child process, deliberately

Bun's shell resolves binaries from the real process PATH. Neither mutating process.env.PATH nor $.env({PATH}) nor .env({PATH}) redirects it — I verified all three. An in-process stub is silently ignored, and the test then runs the developer's real ix against their real graph (which is exactly what happened on my first attempt). A child process with its own PATH is the only way to stub it, and it covers the real spawn path as a bonus.

Verification

Each new test was checked to fail without its fix, not just pass with it:

• with the timer fix in place but safeRun reverted, keeps the JSON body when ix exits non-zero fails on its assertion in 54ms — showing exactly the #539 symptom rather than a timeout.
• reverting both fails all four.

Full suite 95 passed / 0 failed (91 existing + 4 new), 649ms.