fix(#1116): address review nits - dedup log callback, comment stderr truncation

hive-priv/src/main.rs

@@ -440,6 +440,10 @@ async fn container_run_streaming(
 
     let status = child.wait().await.context("wait nixos-container")?;
     if !status.success() {
+        // Only the last stderr line is embedded — the full stderr was
+        // already forwarded line-by-line as PrivEvent::Line messages and
+        // is captured in build_logs.sqlite by the caller. Keeping the
+        // error message short avoids bloating the anyhow chain.
         bail!(
             "nixos-container {} failed ({}): {}",
             args.join(" "),