chore: extract ACP stdio transport pre-patch

[ssfdust]

ACP stdio transport pre-patch

Extracts independently-mergable fixes from the ongoing ACP work in #2858.

Background

When spawning forge machine stdio as an ACP subprocess, stdin is a pipe
that remains open for bidirectional JSON-RPC communication. This patch
resolves three classes of bug discovered during ACP integration testing.

Changes

1. stdin pre-read encapsulation (cli.rs, main.rs)
   Added Cli::uses_stdin() method that centralizes the decision of
   which subcommands own stdin. Subcommands opt in via uses_stdin()
   rather than having the startup pipeline guess from a hardcoded
   exclusion list. This makes it easy to add new stdin-consuming
   subcommands (e.g. an ACP stdio server) without touching the
   startup logic.

2. tool output leaking to stdout (context.rs, tool_executor.rs)
   Shell tool execution always streamed raw output to io::stdout(),
   corrupting the ACP JSON-RPC stream. Added a silent: bool field
   on ToolCallContext (the correct home for per-invocation runtime
   flags). Default false, ACP sets .silent(true) — output then
   goes to io::sink() instead.

3. stderr vs stdout discipline (main.rs, sandbox.rs)
   Panic hook and worktree status messages used println!, which
   writes to stdout and contaminates structured transport. Changed
   to eprintln! (stderr).

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}