evidencectl: render_discovery_description discards the Evidence child's stderr

[jeremi]

render_discovery_description captures the Evidence child's stderr and then discards it, so a failed provider publication compilation surfaces only a fixed string with no diagnosis.

In crates/registry-evidencectl/src/authoring.rs at v0.25.0:

fn render_discovery_description(evidence_bin: &Path, config_path: &Path) -> Result<Vec<u8>> {
    let output = Command::new(evidence_bin)
        // ...
        .output()
        .with_context(|| { /* ... */ })?;
    if output.status.success() {
        return Ok(output.stdout);
    }
    bail!("Evidence rejected provider publication compilation")   // output.stderr dropped
}

output.stderr is populated and never read. Whatever Evidence explained about why it rejected the configuration is lost, and the caller gets one sentence that is identical for every cause.

The sibling function nineteen lines above already does this correctly:

fn check_with_evidence(evidence_bin: &Path, runtime_path: &Path) -> Result<()> {
    // ...
    let stderr = String::from_utf8_lossy(&output.stderr);
    let diagnostic = stderr.trim();
    if diagnostic.is_empty() {
        bail!("Evidence rejected the compiled local generation");
    }
    bail!("Evidence rejected the compiled local generation: {diagnostic}")
}

These are the only two .output() call sites in the file, so the divergence looks like an oversight rather than a deliberate difference.

Suggested fix: mirror the check_with_evidence shape, keeping the bare message when the child wrote nothing to stderr.

Impact: diagnosability only. No behavioural or security change: the command still fails closed, and stderr from a locally invoked, operator-supplied evidence binary is no more sensitive than the stderr already relayed by check_with_evidence.