age: include stderr when identity commands fail

[armarquez]

Summary

• Include stderr in errors from failed age identity commands so credential-provider diagnostics reach SOPS users.
• Preserve wrapped command errors and keep stdout out of error messages, including when a command emits key material before failing.

Test plan

• Regression test fails against the original implementation.
• Age package tests pass on upstream main and v3.13.3.
• Cover diagnostic, empty, padded, and whitespace stderr; successful commands; exit status preservation; and stdout isolation.
• CLI decryption with a disposable age key verifies successful reads and credential-provider failures.