[lx-1997]

A bounded ripgrep attempt that times out or exits with unreadable-directory errors but no stdout currently returns null. The caller then starts a JavaScript directory walk with another budget. On the actual macOS root/HOME regression this exceeds the 30-second test cap and leaves the test process running.

Retain bounded ProcessError output even when empty, so the caller does not start another scan. Add an optional onIncomplete callback while preserving the existing array/null return shape; the built-in tools now identify incomplete output instead of claiming that no files or matches exist. Ordinary unbounded failures keep their existing fallback behavior.

Validation:

• Owned executable regressions cover files/code, exit 2/timeout, empty/partial stdout, incomplete messages and unbounded-error fallback. Before the fix, four empty-output cases failed while four partial-output controls passed.
• The final 17-test selection (new owned-process cases, real root/HOME integration and generated-noise exclusion) passed. The real root/HOME case finished in approximately 8 seconds on this machine.
• npm run check and npm run smoke passed.

Scope: the executable fixture is POSIX-specific; Windows retains its real integration suite. This does not prove a strict end-to-end deadline for every search: post-rg file stats and the original no-rg/non-ProcessError JavaScript fallback are unchanged. An incomplete result is not proof of a complete scan or absence of matches. Full CI remains required before release.