Apply the webFetch timeout to the response body

[RenKoya1]

webFetch arms a 30s abort timer, but clears it in the finally of the fetch() call — which resolves as soon as the response headers arrive. The body read that follows therefore runs with no deadline: a response whose headers arrive promptly and whose body then stalls holds the agent's webFetch tool call open until the Worker itself gives out. HARD_MAX_BYTES bounds the size, not the time.

The change keeps the timer armed across the body read and clears it in a single finally, so an abort mid-body surfaces as the same Fetch timed out after 30000ms error the header path already produces. The diff looks larger than it is — most of it is the existing final-URL / Content-Signal / readBodyCapped block moving inside the try unchanged.

Verification

Added a regression test that stubs fetch with a body that yields one chunk and then only ends on abort, and advances fake timers past the deadline.

• Without the fix: the test hangs and fails on the 5s vitest timeout; the captured AbortSignal is still un-aborted after 60 simulated seconds.
• With the fix: webFetch rejects with Fetch timed out after 30000ms.

pnpm exec tsc --noEmit clean, workshop-backend suite 280/280 passing, oxlint reports nothing new.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[RenKoya1]

I have read the CLA Document and I hereby sign the CLA