executor: filter command output lines instead of buffering all of them

[paskal]

Previously, Local.Run and Remote.sshRun streamed stdout to the log and at the same time retained every byte in a bytes.Buffer, then handed the whole buffer to splitOutputLines, which copied it again. A command printing a large log therefore cost roughly two copies of its output, including at the ten call sites that discard the result.

After this change, RunOpts carries KeepLine func(line string) bool, a predicate deciding which lines Run returns; a nil predicate keeps every line. Every line still reaches the log in full, so this bounds only what the caller retains. Script passes the same setvar test its parse loop uses, so the two cannot drift; Echo keeps the non-empty lines it reports; the sites that ignore the result share a discardOutput value.

The capture is now a streaming writer in place of the buffer, so output is never fully retained. It reproduces the previous splitOutputLines(buffer.String()) exactly, which the tests pin across five write chunk sizes so that a line split across writes, a \r\n pair split down the middle and a run of newlines all give the same answer as the batch split. A line of any length still arrives whole, and an unterminated final line is returned like a terminated one.

Measured with the reproduction from #363, three runs each:

	peak RSS
before	215.9, 216.0, 217.3 MB
after	27.8, 28.0, 27.2 MB

The issue's control run, with the same output sent to /dev/null, sat at 21.5 to 22.4 MB.

Verbose is dropped from RunOpts, dead since 6c872a3: all three executors took it as _ and verbosity comes from MakeLogs. As noted in the issue, KeepLine makes RunOpts non-comparable, which nothing in the tree depends on.

A line spanning several writes has to be staged, and the staging buffer is released once it grows past 64KiB rather than being kept for reuse. Holding it would pin the longest line for the rest of the command, which is the retention this change removes elsewhere.

The last commit is the maskSecrets point raised at the end of the issue: it compiled a regexp per secret on every call, and it is called for every line of every command. Patterns are now compiled once in MakeLogs and shared by every writer. On a typical log line with four secrets configured, masking drops from 6031 to 2190 ns/op. It sits on its own commit and can be split out if you would rather keep it separate.

Resolves #363.