setup: surface child-process stderr, and fail loudly when the cloned source (git_url) is empty

Environment

• pyappify: v1.2.3 (via ok-oldking/pyappify-action@master, version: v1.2.3)
• Runner: windows-latest
• pyappify.yml: requires_python: "3.12", requirements: "requirements.txt"

What happened

pnpm tauri build succeeds (the exe and the NSIS bundle are both produced), but the
per-profile packaging step fails:

Processing profile: China
[command]ok-ap.exe -c setup -p China
Command-line mode: Setting up app 'ok-ap' with profile 'China'.
Setup failed: Msg("Command failed (...\python\python.exe -m pip install -r ...\working\requirements.txt): exit code: 1")

It fails in about 5 seconds and there is no pip output at all in the log, which makes it
very hard to diagnose.

Root cause

In src-tauri/src/python_env.rs, KNOWN_PATCHES maps 3.11 / 3.12 / 3.13 to python.org archives:

("3.12", "3.12.10", "https://www.python.org/ftp/python/3.12.10/python-3.12.10-amd64.zip", ...)
("3.11", "3.11.9",  "https://www.python.org/ftp/python/3.11.9/python-3.11.9-amd64.zip", ...)
("3.13", "3.13.5",  "https://www.python.org/ftp/python/3.13.5/python-3.13.5-amd64.zip", ...)

These are the Windows embeddable packages. I downloaded python-3.12.10-amd64.zip and
inspected it:

• Lib/site-packages/ contains only README.txt — pip is not installed
• Lib/ensurepip/_bundled/pip-25.0.1-py3-none-any.whl is present, so pip can be bootstrapped

However python_env.rs never bootstraps pip (grepping src/ for ensurepip / get-pip
returns nothing). install_requirements() directly runs python -m pip install ..., so the
command always fails with No module named pip.

By contrast, 3.10 and below use the python-build-standalone install_only_stripped builds,
which do ship pip — that is why lower versions work.

Suggested fix

After extracting the Python distribution, bootstrap pip when it is missing, e.g.
python -m ensurepip --upgrade (the bundled wheel is already there), or switch 3.11+ to
python-build-standalone install_only builds.

Nice-to-have

Forward the child process's stderr to the log in run_command_and_stream_output.
Right now a failing pip prints nothing at all, which cost a lot of time to diagnose.

Why we can't work around it

The project pins requires-python = ">=3.12,<3.13", so downgrading to 3.10 is not an option,
and there is no config for the Python download URL (only pip index / cache settings are
configurable). We are currently blocked on packaging.

Reference

Failing CI run: https://github.com/AliceJump/OK-AzurPromilia/actions/runs/35217862838

Start in src-tauri/src/python_env.rs, reading KNOWN_PATCHES and install_requirements(), then inspect run_command_and_stream_output for the missing stderr handling. Reproduce the Windows packaging failure with a Python 3.12 embeddable archive and verify that pip is bootstrapped before requirements installation. Done means 3.11+ setup succeeds and child-process stderr appears in the log.