cmd: support reading stderr

add ">&2" to command executor to be able to read stderr (and optionally
stdout separately)