Foreground cancellation and bounded hostile I/O cleanup

Race recall, follow-up setup, provider work, and every body read against the foreground abort/deadline; byte caps cannot bound a reader that never settles. On cancellation, return promptly and asynchronously roll back late results or cancel/release late readers without awaiting hostile cleanup. readForegroundBody must bound non-OK diagnostic reads by timeout and abort, always release the reader, sanitize content, preserve status, and clamp far-future HTTP-date Retry-After to 300 seconds. Suppress cleanup failures and test stalled bodies, handoff races, late results, and non-settling cleanup.