fix(client): surface background service startup errors - #41802

Summary

• move shared contender process handling out of the Promise and Effect service implementations
• let the CLI emit an explicit managed-service startup error marker for safe, actionable failures
• return the marked port-conflict error instead of replacing it with an exit code or final timeout
• ignore arbitrary child stderr so local paths, configuration details, or secrets are not surfaced by Desktop

Problem

When the Desktop beta background service cannot bind its configured port, the child CLI knows the actionable Managed service port ... is already in use error. The client currently discards that result. Overlapping contenders can then mask their nonzero exits until the two-minute ensure deadline, leaving Desktop to show only Timed out waiting for the background service to start.

The child may also write unrelated startup diagnostics to stderr, so forwarding stderr wholesale is not an acceptable error contract. This change uses an explicit marker emitted only for the controlled service error and returns only that marked message.

Testing

• bun typecheck in packages/client
• bun test test/service.test.ts test/promise-service.test.ts --timeout 25000 in packages/client (21 pass)
• GOMAXPROCS=2 bun typecheck in packages/cli

Requested by: @neriousy (Filip via Slack)