[RaphaelFakhri]

Summary

OutputCaptureRunner.CaptureOutput reads stderr into a single 1024-byte buffer that is allocated once, outside the read loop, and sends buf[:n] on the unbuffered stderr channel. Once the receiver takes the slice, the reader goroutine immediately calls Read again into the same backing array. The receiver can then see the bytes of the next chunk in place of the chunk it received, so stderr returned by /v1/sandbox/run can be corrupted or duplicated. The stdout goroutine already allocates a new buffer per read and does not have this problem.

This change moves the stderr buffer allocation inside the loop, matching the stdout reader.

Changes

• internal/core/runner/output_capture.go: allocate the stderr read buffer per iteration.
• internal/core/runner/output_capture_test.go: add TestCaptureOutputDoesNotReuseStderrChunkBuffer, which receives the first stderr chunk, lets the reader consume a second chunk, and checks that the first chunk is unchanged.

Testing

The runner package init creates the sandbox user, so the unit tests run as root (the CI workflow runs only tests/integration_tests).

go test ./internal/core/runner/ -run TestCaptureOutputDoesNotReuseStderrChunkBuffer -count=20 -v

• Before the fix: 20 of 20 runs fail with expected first stderr chunk to stay intact, got "XXXXX".
• After the fix: 20 of 20 runs pass.
• go test ./internal/core/runner/ -count=1: all 4 tests pass.
• gofmt and go vet are clean.

Fixes #293