fix(engine): surface CalledProcessError.stderr in deploy-failure log + status reason

str(CalledProcessError) is just 'Command ... returned non-zero exit
status N' — the stderr (where the buildx recovery hint lives) was
being silently dropped from both the deploy log line and the
persisted 'failed' status reason.

New _format_subprocess_error helper appends .stderr when the
exception is a CalledProcessError. Applied to transition_status
reason and the background-deploy log message so operators and the
UI see the real failure, not just the exit code.

This is what makes the buildx preflight hint from 86b9dec actually
reach the user.

decnet/web/router/topology/api_deploy_topology.py

@@ -34,7 +34,11 @@ async def _run_deploy(topology_id: str) -> None:
     except asyncio.CancelledError:  # pragma: no cover — shutdown
         raise
     except Exception as exc:  # noqa: BLE001
-        log.error("background deploy of %s failed: %s", topology_id, exc)
+        from decnet.engine.deployer import _format_subprocess_error
+        log.error(
+            "background deploy of %s failed: %s",
+            topology_id, _format_subprocess_error(exc),
+        )
 
 
 @router.post(