Review findings on the subagent surface:

- A non-zero subagent `exitCode` now counts as a failure regardless of
  whether the parent tool has ended. Gating it on `completed` let a finished
  child report "completed" while `piSubagentOutput` returned its stderr as
  the result, and left exit-code-only failures "running" until the parent
  tool finished.
- Fall back to `stderr` with `||` rather than `??`, so a failure carrying an
  empty `errorMessage` no longer hides a non-empty `stderr`.
- Log only the length of pi's extension-error and rejected-steer payloads.
  Both are unbounded remote output that can carry prompt text or
  credentials, matching the `stderrLength` form used in `PiRpc.ts`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>