fix(security-guidance): preserve Python probe errors - #86746

What this does

Fixes #86709 by preserving stderr from Python interpreter probes and reporting the diagnostics when all candidate interpreters fail.

Previously, sg-python.sh redirected probe stderr to /dev/null. When python3, python, and py -3 all failed, users only saw the generic "no working Python 3 interpreter found" message, which made failures such as broken pyenv shims, Microsoft Store stubs, or transient process errors difficult to diagnose.

Changes

• Capture probe stderr in a temporary file while checking each Python candidate.
• Report the captured probe errors when no working Python 3 interpreter is found.
• Keep probe stderr suppressed when a later candidate succeeds, preserving the existing fallback behavior.
• Make diagnostic capture best-effort so failure to create the temporary log does not change the existing interpreter-selection behavior.
• Clean up the temporary diagnostic file after interpreter selection.

Test plan

• Reproduced the reported failure with broken python3 and python shims and verified their stderr is now included in the final error.
• Verified that a failing python3 candidate can still fall through to a working python candidate without exposing the failed probe's stderr.
• Verified the existing py -3 fallback remains functional.
• Verified the shell script with bash -n.
• Added a regression test covering the all-candidates-failed diagnostic path and fallback behavior.

Fixes #86709