v0.311.0 (before the build): the repair's commands run quietly — no household file name can reach a log or the operator event

Security review of 8d862e4: compose's shared runner logs a failed command's stdout and puts its
stderr in the error, and that error became the event's `problem`. The after_unclean_boot commands now
run through a quiet runner (nothing logged, stderr discarded) and `problem` keeps the exit code only.
TestAUB_AFailingCommandLeaksNoOutput, red-proofed.

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

CHANGELOG.md

@@ -21,6 +21,11 @@ the repair and the household's note do not depend on it. **Catalog:** Immich's `
 - **The operator:** `app_repaired_after_crash` — counts only (found / repaired / still broken / lost, the boot, the
   duration, a skip reason). warning when anything is lost, still broken, failed or skipped; info when all repaired;
   nothing when nothing was found. File names never reach a log line or an event (tests assert both).
+- **Security review of `8d862e4` (fixed before the build):** the block's commands first ran through compose's shared
+  runner, which LOGS a failed command's stdout and puts its stderr into the error — and that error text went into the
+  event's `problem`. A failing lost-file check could have sent a household's file name to the log and the hub. Now the
+  commands run through a quiet runner (no logging; stderr discarded) and `problem` keeps the exit code only
+  (`TestAUB_AFailingCommandLeaksNoOutput`, red-proofed).
 - Tests: `internal/stacks/after_unclean_boot_test.go`, `internal/aftercrash/aftercrash_test.go`,
   `internal/crashboot` (`TestDecided_*`), `internal/notify/app_repaired_after_crash_test.go`,
   `internal/web/lost_files_note_test.go`, one new parity fixture (`app_info_lost_files`, the new card only).