fix(runner): surface a failing tool's stderr under stdout-only filtering

`uv run rtk pytest` produced no output at all when pytest was missing from the
venv: exit 1, a single newline on stdout, nothing on stderr. A test run that
prints nothing and reports no error reads as a quiet pass, leaving the exit code
as the only signal.

The trigger is uv, but the defect is in the runner. Filters that compress stdout
pass RunOptions::stdout_only, which keeps stderr out of the filter input — and
run_captured_filter only ever emitted stderr inside its skip_filter_on_failure
branch. Callers that pair stdout_only with early_exit_on_failure (ls, tree) hit
that branch and print stderr; callers that don't (pytest, ruff, prettier, go
test, golangci-lint, phpunit, phpstan, pint, rubocop) captured stderr and
dropped it on the floor.

Standalone `rtk pytest` looks fine only because python is absent there: the spawn
fails outright and the anyhow error prints. Under `uv run` the venv supplies
python, so rtk falls back to `python -m pytest`, the spawn succeeds, and the
child's "No module named pytest" goes to the stderr that was being discarded.

Emit stderr when the child fails. Only on failure: on a successful run stderr is
the incidental noise RTK exists to suppress, and filtered stdout already carries
the result.

Fixes rtk-ai#3026

Author: georgyia

src/core/runner.rs

@@ -122,6 +122,15 @@ where
         return Ok(exit_code);
     }
 
+    // `filter_stdout_only` keeps stderr out of the filter input, so nothing
+    // downstream can surface it — a failing child's diagnostics would be dropped
+    // and the exit code left as the only signal (#3026). Emit them here. Only on
+    // failure: on a successful run stderr is the incidental noise RTK exists to
+    // suppress, and the filtered stdout already carries the result.
+    if opts.filter_stdout_only && exit_code != 0 && !result.raw_stderr.trim().is_empty() {
+        eprint!("{}", result.raw_stderr);
+    }
+
     let text_to_filter = if opts.filter_stdout_only {
         raw_stdout
     } else {

tests/stderr_passthrough_test.rs

@@ -0,0 +1,69 @@
+#![cfg(unix)]
+//! A failing tool's stderr must reach the user (#3026). Filters that compress
+//! stdout run with `RunOptions::stdout_only`, which keeps stderr out of the filter
+//! input — so unless the runner emits it, the diagnostics are dropped and the exit
+//! code becomes the only surviving signal.
+
+use std::fs;
+use std::os::unix::fs::PermissionsExt;
+use std::process::Command;
+
+const DIAGNOSTIC: &str = "shim-diagnostic: dependency is missing";
+
+/// A fake `ruff` that fails the way real tools do: message on stderr, nothing on
+/// stdout, nonzero exit. `rtk ruff` filters stdout only, which is the path under
+/// test; `resolved_command` resolves via PATH, so the shim takes precedence.
+fn shim(exit_code: i32) -> tempfile::TempDir {
+    let dir = tempfile::tempdir().unwrap();
+    let bin = dir.path().join("ruff");
+    fs::write(
+        &bin,
+        format!("#!/bin/sh\necho '{DIAGNOSTIC}' >&2\nexit {exit_code}\n"),
+    )
+    .unwrap();
+    fs::set_permissions(&bin, fs::Permissions::from_mode(0o755)).unwrap();
+    dir
+}
+
+fn rtk_ruff(shim_dir: &tempfile::TempDir, db: &tempfile::TempDir) -> std::process::Output {
+    let path = format!(
+        "{}:{}",
+        shim_dir.path().display(),
+        std::env::var("PATH").unwrap_or_default()
+    );
+    Command::new(env!("CARGO_BIN_EXE_rtk"))
+        .args(["ruff", "check", "."])
+        .env("PATH", path)
+        // Keep tracking off the developer's real database.
+        .env("RTK_DB_PATH", db.path().join("t.db"))
+        .output()
+        .expect("rtk")
+}
+
+#[test]
+fn failing_tool_stderr_reaches_the_user() {
+    let db = tempfile::tempdir().unwrap();
+    let out = rtk_ruff(&shim(1), &db);
+
+    assert_eq!(out.status.code(), Some(1), "exit code must propagate");
+    assert!(
+        String::from_utf8_lossy(&out.stderr).contains(DIAGNOSTIC),
+        "diagnostic swallowed — stderr was {:?}, stdout was {:?}",
+        String::from_utf8_lossy(&out.stderr),
+        String::from_utf8_lossy(&out.stdout)
+    );
+}
+
+#[test]
+fn successful_tool_stderr_stays_suppressed() {
+    // On success stderr is the incidental noise RTK exists to compress away, and
+    // the filtered stdout already carries the result.
+    let db = tempfile::tempdir().unwrap();
+    let out = rtk_ruff(&shim(0), &db);
+
+    assert_eq!(out.status.code(), Some(0));
+    assert!(
+        !String::from_utf8_lossy(&out.stderr).contains(DIAGNOSTIC),
+        "successful run must not leak tool stderr"
+    );
+}