CLI wrappers should pass through child CLI stdout/stderr without selective capture

[iamh2o]

Observed during local Dayhoff bring-up on April 8, 2026:

• Some service CLIs wrap child CLIs such as TapDB and Cognito and either capture output or selectively re-emit only part of it.
• This makes bootstrap/debug logs inconsistent across services and can hide useful stderr progress or failure detail.

Requested change:

• Audit the service CLI wrappers that invoke TapDB and Cognito.
• When a child CLI is wrapped, pass through both stdout and stderr to the parent process rather than capturing and selectively reformatting it.
• If a wrapper must capture output for machine processing, preserve an operator mode that still streams the child process output unchanged.
• Add tests where practical to lock this in.

Why this matters:

• Dayhoff/local operator workflows depend on being able to see the real child CLI output during bootstrap and failure handling.
• Ursa currently appears to capture and reprint TapDB output differently from the other services; the goal is consistent raw passthrough behavior across the fleet.