Keep webFetch's timeout armed until the response body has been read

[snowyukitty]

Refs #27 — this covers the timeout half only, so please keep that issue open for the rest (see the
list at the bottom).

fetch() resolves as soon as the response headers arrive, and the finally cleared
FETCH_TIMEOUT_MS right there — before readBodyCapped() ran. The declared 30s bound therefore
only covered connect and time-to-headers, and the body read had no deadline at all.
readBodyCapped is a bare while (true) { await reader.read() } with no signal, so a server that
answers promptly and then stalls holds the agent turn open with nothing to stop it.

The 1 MiB cap does not substitute for a deadline: it bounds total bytes, so a server trickling
below the cap never trips it.

Measured on workerd, against a server that flushes headers then writes one byte every 2s, with
the timeout shortened to 5s:

variant	result
before this PR	still pending when the client gave up at 25s
just keeping the timer armed	AbortError after 5057ms
this PR	Error: Fetch timed out after 5000ms after 5039ms

The middle row is why the diff is not a one-line move: the abort does reach an in-flight
reader.read(), but the catch that produces the friendly message wraps only the fetch call, so
a timeout during the body read would otherwise surface as a bare AbortError. The change clears
the timer on each exit path and maps an abort during the body read onto the same error.

Two things this deliberately leaves alone, both because they change the function's signature or its
caller, and both noted in #27:

• The AbortSignal pi-agent-core passes to a tool as execute's third argument is still dropped
  by the webFetch tool, so Stop still cannot cancel a slow fetch.
• convertToMarkdown runs after the body read, so it stays outside the deadline.

Verified: pnpm lint:check and pnpm --filter @gadgets/workshop-backend types:check pass.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[snowyukitty]

recheck

[snowyukitty]

Closing this in deference to CONTRIBUTING.md and your note on #39.

The finding and the workerd measurements are in #27, which stands on its own — same diff, the
four-variant timing table, and the two related findings this PR deliberately left out. No review
requested here; issues only from here on.