The dynamic loader writes warnings to stderr before codexbar produces any
output, so they lead every bounded stderr excerpt the widget shows as a
failure reason. The common case is glibc's

  codexbar: /lib64/libcurl.so.4: no version information available (required by codexbar)

emitted when the upstream glibc CLI build, which records a Debian-only
CURL_OPENSSL_4 version requirement, runs on a distro that ships libcurl
without symbol versioning (Fedora, RHEL, Arch, openSUSE).

cliMessage collapses whitespace and truncates to 500 characters, so with a
full-path warning ahead of it the real CLI error was pushed out of the
visible part of the label. configDebug is hit whenever the exit code is
non-zero, and the error paths in main, configProviders and configDisplay
are hit whenever stdout is empty.

Add SafeText.stripLoaderDiagnostics, which drops those lines within the
existing bounded-scan window and falls back to the original text when the
warning was all stderr carried, so a failure never surfaces as an empty
message. Fatal loader errors such as "error while loading shared
libraries" are deliberately preserved: those are the actual failure.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>