fix(lifecycle): stop surfacing the userEnvProbe's benign shell stderr

The userEnvProbe runs an interactive login shell (`bash -lic env`) to capture
the container environment. On a container without a controlling TTY, bash prints
"cannot set terminal process group (N): Inappropriate ioctl for device / no job
control in this shell" to stderr — benign noise the TS CLI does not show.

ShellServer.Exec surfaced *all* command stderr on the log at LevelInfo, so that
probe noise leaked into the visible output of `up` (before postCreateCommand)
and `exec` (before the command result). Make ShellServer.Exec quiet — it is only
called directly by the probe — and move hook-stderr surfacing to
ShellExecutor.Exec via a new ExecWithStderr, so failing/chatty lifecycle hooks
still produce diagnostics.

Verified end-to-end against mcr.microsoft.com/devcontainers/base:ubuntu: the
pre-fix binary reproduces the "no job control" lines on `up`/`exec`; the fixed
binary's output is clean while a real command's own stderr (e.g. "node: command
not found") is still shown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: aledbf

internal/lifecycle/shell.go

@@ -27,38 +27,48 @@ type ShellServer struct {
 	containerID string
 	user        string
 	env         []string // remoteEnv "KEY=VALUE", applied to every exec
-	log         log.Logger
 }
 
 // NewShellServer binds a ShellServer to a container. user (docker exec -u) and
 // remoteEnv entries ("KEY=VALUE", docker exec -e) are applied to every command,
 // matching the TS CLI which runs lifecycle hooks and the userEnvProbe as the
 // remote user.
-func NewShellServer(ctx context.Context, exec ContainerExecutor, containerID, user string, logger log.Logger, remoteEnv ...string) (*ShellServer, error) {
+// The logger param is accepted for call-site stability and future use; the
+// server currently logs nothing itself (callers surface command output).
+func NewShellServer(ctx context.Context, exec ContainerExecutor, containerID, user string, _ log.Logger, remoteEnv ...string) (*ShellServer, error) {
 	return &ShellServer{
 		ctx:         ctx,
 		exec:        exec,
 		containerID: containerID,
 		user:        user,
 		env:         remoteEnv,
-		log:         logger,
 	}, nil
 }
 
 // Exec runs a command inside the container and returns its stdout and exit code.
-// The command's stderr is surfaced on the log (the TS CLI streams hook stderr)
-// rather than returned, so a failing hook still produces diagnostics.
+// stderr is intentionally NOT surfaced: the only direct caller is the internal
+// userEnvProbe, whose interactive-login shell (`bash -lic`) prints a benign
+// "cannot set terminal process group / no job control" warning to stderr on a
+// container without a controlling TTY — the TS CLI does not show it either.
+// Lifecycle hooks surface their own stderr via ShellExecutor (ExecWithStderr).
 func (s *ShellServer) Exec(command string) (stdout string, exitCode int, err error) {
-	out, errText, code, err := s.exec.ExecInContainer(s.ctx, s.containerID, s.user, s.env, command)
+	out, _, code, err := s.exec.ExecInContainer(s.ctx, s.containerID, s.user, s.env, command)
 	if err != nil {
 		return "", -1, err
 	}
-	if strings.TrimSpace(errText) != "" && s.log != nil {
-		s.log.Write(errText, log.LevelInfo)
-	}
 	return out, code, nil
 }
 
+// ExecWithStderr is Exec but also returns the command's stderr, for callers that
+// surface command diagnostics (lifecycle hooks).
+func (s *ShellServer) ExecWithStderr(command string) (stdout, stderr string, exitCode int, err error) {
+	out, errText, code, err := s.exec.ExecInContainer(s.ctx, s.containerID, s.user, s.env, command)
+	if err != nil {
+		return "", "", -1, err
+	}
+	return out, errText, code, nil
+}
+
 // Close is a no-op: each command is its own exec, so there is no persistent
 // process to tear down. Retained for API symmetry with callers that defer it.
 func (s *ShellServer) Close() error { return nil }
@@ -86,13 +96,18 @@ func (e *ShellExecutor) Exec(command string) error {
 	if e.WorkDir != "" {
 		command = fmt.Sprintf("cd %s && %s", shellSingleQuote(e.WorkDir), command)
 	}
-	stdout, code, err := e.Server.Exec(command)
+	stdout, stderr, code, err := e.Server.ExecWithStderr(command)
 	if err != nil {
 		return err
 	}
 	if stdout != "" {
 		e.Log.Write(stdout, log.LevelInfo)
 	}
+	// Surface hook stderr (the TS CLI streams lifecycle-hook stderr) so a failing
+	// or chatty hook still produces diagnostics.
+	if strings.TrimSpace(stderr) != "" {
+		e.Log.Write(stderr, log.LevelInfo)
+	}
 	if code != 0 {
 		return &CommandError{Command: originalCommand, ExitCode: code}
 	}