#30822 ci: enforce absolute fast-check request deadlines

The fast-checks runtime’s 180-second census bound now covers the complete HTTP operation, including response bodies and signed artifact downloads. Socket inactivity timeouts alone let a peer that drips bytes keep response.read() alive indefinitely. A scoped process alarm interrupts open, TLS, headers and body reads at the monotonic deadline, restores any prior alarm, and leaves clients without a deadline unchanged. No worker threads are created for timeout enforcement.

This is the fix-forward for the blocking audit of #30762 and keeps its strict ROUTE_TOKEN and separate SNAPSHOT_TOKEN behavior. It also covers the shared pr_runner_pool.GitHub client used by the approved runtime. #30724 overlaps only in the same client file for unrelated cmux-tui selector guards; this branch does not alter those selectors.

Observed / Not run

At 540050e3d9d2ee24da18184a497d06bec272f974, the fast-checks picker suite passes 13/13, including local HTTP drip-server regressions for API JSON and signed artifact bodies; both server and handler threads are stopped and joined. Full tests.test_ci_pr_runner_pool passed 243 tests before this final test-only addition; py_compile and git diff --check pass. The focused suite was run again at the final head.

Review audit: #30762 (merged 265c68a569ac4af557bdd5ad2e4b26365a453503); this change addresses the audit finding that socket timeouts did not establish an absolute body-read deadline.

Changelog

none

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Enforces absolute wall-clock deadlines on fast-checks GitHub API and artifact download requests so a peer dripping bytes can no longer keep response.read() alive past the 180-second census bound.

• Replaces socket inactivity timeouts alone with a scoped SIGALRM process alarm covering connect, TLS, headers, and body reads; restores any prior alarm and timer on exit.
• Leaves clients without a deadline and non-main-thread callers on the legacy per-socket timeout path.
• Adds HTTP drip-server regression tests for JSON API responses and signed artifact blob downloads; both handler and server threads are stopped and joined.