Introduces `ExecOutput { status, stdout, stderr }` and a new
`K8sClient::exec_pod_capture` method that captures both streams plus
the reported exec status regardless of exit code. The existing
`exec_pod_capture_output` keeps its Result<String, String> shape
(success -> stdout, failure -> stderr) for back-compat but is now a
thin wrapper around the new method.
This closes a footgun where stdout was dropped on any non-zero exit,
which mattered for CLIs that emit structured output on stderr's side
(e.g. `bao status -format=json` exits 2 on a sealed or uninitialised
vault but still writes its JSON to stdout).
Migrates `OpenbaoSetupScore::unseal`'s sealed-status probe to use
the new method so it parses the `sealed` field authoritatively
rather than treating "any non-zero exit" as sealed. Warnings are
logged on either fallback path so operators can diagnose if the
probe ever produces an unexpected shape.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Sylvain Tremblay
f3341de042