Successful codexbar runs could print to stderr (glibc loader diagnostics do),
and the provider enable/disable, set-api-key, and descriptor action handlers
consulted stderr before trusting a parsed, error-free payload with exit 0.
Those successful mutations were then reported as failures: the switch visually
reverted, the shared revision stayed stale, and a saved API key surfaced the
loader noise as the error text.

The precedence rule now lives once in ProviderConfigProtocol.commandOutcome
and keeps every historical winner pair except the buggy one; timeout codes,
non-zero exits, structured error/cancel envelopes, and standalone stderr all
retain their prior ordering. The three handlers keep only localization.