[Enhancement]: LocalFilesystemWithShell.execute — bound capture during drain, Future-based teardown, dual-stream test

Follow-ups from the review of #2839 (which fixed the pipe deadlock by draining stdout/stderr concurrently with `waitFor`):

1. **Bound memory while draining, not after.** `maxOutputBytes` is applied post-hoc to the assembled string, so a huge output can OOM before truncation runs. Cap `buf.write` once the buffer hits `maxOutputBytes`, keep reading-and-discarding so the OS pipe stays drained, and mark the result `truncated` when bytes were dropped.

2. **Align reader teardown with `ShellCommandTool`.** `join(timeout)` may return while the drainer thread is still alive, and `ByteArrayOutputStream` is not thread-safe, so `toString()` can race with `write`. Prefer `Future.get(timeout)` + `cancel(true)` (discarding the untrusted buffer), or interrupt the drainer when it is still alive after join.

3. **Add a stderr / dual-stream regression test** alongside the stdout one added in #2839.

Happy to send the PR(s) once #2839 is merged.