fix: cancel and bound upstream runtime requests

[gaojude]

An MCP client timeout currently leaves upstream network requests running. Protocol probes also return after headers without releasing their response bodies, so a server that sends headers and keeps its body open can retain connections after the caller gives up.

Pass the MCP request's abort signal through discovery and runtime calls, bound upstream requests (including response-body reads) to 60 seconds, and cancel status-only probe bodies. An internal timeout option lets regression tests exercise the same deadline path quickly. Update the README and add a patch changeset.

Validation:

• Five new lifecycle assertions failed against the original implementation; the healthy control passed.
• pnpm build, pnpm typecheck, and the complete pnpm exec vitest run: 39 tests passed.
• Real loopback HTTP tests cover stalled headers, stalled bodies, a 100 ms request deadline, probe-body release, pre-aborted callers, and successful requests.
• A real SDK stdio client timed out a request to an indefinitely streaming endpoint. Both upstream responses closed, and the same MCP connection then successfully queried a real Next.js 16.3.4 server.

Local validation used macOS arm64, Node.js 24.19.0, and pnpm 9.15.9. The uploaded GitHub-signed commit has the same Git tree as the tested checkout.