fix(doctor): join the stderr drain before building the crash detail - #3165

Closes #3138

Problem

_drain_stderr started a daemon reader thread and returned only the ring. After the handshake failed and the exit code was known, mcp_smoke_check read the ring immediately — but the process having exited does not mean the reader has consumed the pipe's last lines. On a busy runner the ring could still be empty at that point, so a server that died on import was reported as just server exited with code 1 and the traceback naming the fault was lost. This is the intermittent test_the_registered_command_is_the_one_launched CI failure quoted in the issue (Python 3.11 job; passed on 3.12/3.13 and on rerun).

Reproduced deterministically

Patching the ring's append to time.sleep(0.5) (the loaded-runner interleaving the issue describes — child dead and reaped while the reader is mid-line) makes the current code lose the tail:

detail: server exited with code 1          # ModuleNotFoundError gone

Fix

• _drain_stderr returns (ring, thread) instead of dropping the thread.
• After exit_code is known, the detail joins the reader with _STDERR_DRAIN_GRACE_S = 2.0 before _stderr_tail. The pipe hits EOF when the child exits, so the join returns as soon as the last line lands; the bound keeps a grandchild that inherits and holds the pipe open from stalling doctor.

Tests

• test_a_slow_stderr_drain_still_reports_the_tail — slowed ring append (the race interleaving) still surfaces ModuleNotFoundError; fails on the previous code (verified by mutation).
• test_a_grandchild_holding_the_pipe_cannot_stall_doctor — a reader that never finishes delays the detail by the grace period only, not forever.
• All 13 existing smoke tests unchanged and passing; 26 adjacent doctor tests passing. The 5 failures in the wider tests/unit/cli run fail identically on the pristine tree (local-environment only).