Kiro device-login status body can outlive reconciliation deadlines #6021

Summary

The native Kiro device-login hook and detached finalizer bound only acquisition of a Response, not consumption of its body. A status response whose body never reaches EOF can therefore keep the hook/finalizer alive beyond both the 45-second read budget and the 16-minute reconciliation ceiling.

Current path

• gui/src/components/use-kiro-device-login.ts starts the status fetch without a signal, clones the Response for handoff, and separately awaits the original response.json(). unlessClosed checks only after that promise settles.
• gui/src/kiro-device-login-finalizer.ts races only the inherited/new Promise<Response> against 45 seconds, then awaits response.json() outside the race.
• A never-closing body prevents the finalizer finally from deleting its active entry. The existing body-parsing test mocks only the original response method; the clone retains a complete body and does not reproduce the stall.

Expected fix

Use one owned status-read operation for fetch, body EOF, parse, and public-view validation. Give the complete operation a deadline and cancellation handle, transfer that same operation from the hook to the detached finalizer without cloning/dual consumption, retain terminal-status precedence, and clamp retries to the existing overall deadline. Timeout must settle even if transport cancellation does not.

Required regressions

• A real ReadableStream that emits valid-looking JSON bytes but never closes is cancelled and retried at the read deadline.
• Close/unmount during that read transfers ownership; the hook cannot publish, the finalizer settles exactly once, and the active singleflight entry is released.
• A delayed EOF before the deadline preserves the already-sent terminal status instead of losing it to a later 404.
• An overall deadline shorter than the read timeout cancels the body and does not schedule another full retry delay.

This is a P2 resource/lifecycle reliability defect. It does not establish a remote credential or authorization bypass.