fix(requester): keep non-stream timeout active after headers

[lonr-6]

Summary

• keep the overall request watchdog active for non-stream responses after headers arrive
• preserve the existing behavior for streaming responses, which intentionally clear the watchdog once streaming starts
• make child-process spawning injectable for deterministic lifecycle tests
• add a regression test for a child that emits response headers and then stalls forever

Root cause

FingerprintRequester.request() unconditionally cleared timeoutId as soon as it parsed \r\n\r\n. That is appropriate for long-lived streaming responses, but it also disabled the only JavaScript-side watchdog for normal requests. If the fingerprint child or upstream sent headers and then stopped producing a body without exiting, the Promise could remain pending indefinitely.

The timeout is now cleared after headers only when onDownloadProgress identifies the streaming path. Non-stream requests retain the watchdog until the child exits.

Verification

• deterministic fake-child regression: headers are emitted, the body stalls, and the request rejects with ECONNABORTED instead of hanging
• focused harness passed on Node.js 22
• branch is based on current upstream main (849deac8)

Refs #159
Refs #175