fix(updates): read chunked responses boundedly from feed

[ChickenisLegit]

This extracts the
ead_bounded\ shared helper and uses it to safely consume the release feed in \updates.py, matching the behavior recently landed for the MCP registry in #2232.

As requested by @bolichen97, this is the standalone follow-up PR isolating the \updates.py\ chunking fix.

[iamwhatever]

👋 Hi! This PR's description is missing some required sections from our PR template. Workflow runs won't be auto-approved until the description is updated.

Missing sections:

• ## Problem / Motivation
• ## Why it matters
• ## What changed
• ## Tests

Please update your PR description to include these sections, then push or re-save the description. The workflows will be approved on the next cycle.

[iamwhatever]

👋 Hi! This PR's description is missing some required sections from our PR template. Workflow runs won't be auto-approved until the description is updated.

Missing sections:

• ## Problem / Motivation
• ## Why it matters
• ## What changed
• ## Tests

Please update your PR description to include these sections, then push or re-save the description. The workflows will be approved on the next cycle.

[bolichen97]

👋 Hi! This PR's description is missing some required sections from our PR template. Workflow runs won't be auto-approved until the description is updated.

Missing sections:

• ## Problem / Motivation
• ## Why it matters
• ## What changed
• ## Tests

Please update your PR description to include these sections, then push or re-save the description. The workflows will be approved on the next cycle.

[bolichen97]

🤖 Kiro Crew [operator: bolichen97#bb3ad1ca]: This PR has been inactive for 7+ days with failing CI. I've assessed the blockers and they appear resolvable — I'll push fixes directly to this branch as a co-author.

Assessment: Merge conflict + black-baseline formatting gate + per-file backend coverage floor (80%). Plan: rebase onto main, resolve, fix formatting/baseline graduation, add the missing coverage.

If you'd prefer I don't touch this PR, add the pr-no-autofix label.

[bolichen97]

🤖 Kiro Crew [operator: bolichen97#bb3ad1ca]: Drive-to-green paused — this PR appears superseded by #4858 (merged 2026-08-22).

While preparing the rebase I found that main already carries this exact fix at the same call site:

• Same defect, same site: _fetch_feed_bytes in src/kiro_crew/dashboard/handlers/updates.py now reads the release feed via the shared helper read_capped_response (dashboard/handlers/_shared.py), landed by fix(dashboard): stream HTTP response bodies to EOF instead of one chunk (#4829) #4858 (closes Three HTTP readers truncate chunked responses via a single StreamReader.read() #4829, merged 2026-08-22 07:46Z — about 14h after this PR was opened).
• Equivalent-or-stronger semantics: it drains iter_chunked to EOF, enforces the cap against received bytes (not Content-Length), keeps the over-cap sentinel (len(body) > cap), and additionally clamps the return to cap + 1 bytes so an oversized body can't be buffered whole. It ships with dedicated tests (test/test_read_capped_response.py) and is already the converged shared helper for 3 call sites (updates.py, source_providers.py, feedback.py).
• Residual delta after conflict resolution: only src/kiro_crew/net_utils.py — a second bounded-read helper with zero callers and a weaker contract (unclamped return). Landing it would add a duplicate of read_capped_response rather than fix anything.

Because the remaining fix direction is void (the behavior change is on main; what's left is a caller-less duplicate module), I'm not pushing a rebase and escalating for a human decision instead of driving this green mechanically.

@ChickenisLegit — thank you for the fix and the clean extraction; the behavior you implemented is what main now does. Suggested resolution: close this PR as superseded by #4858. If you'd like the helper consolidated further (e.g. moving read_capped_response out of dashboard/handlers/_shared.py into a top-level net_utils-style module), that would be a separate refactor issue rather than this PR.

[iamwhatever]

🤖 Kiro Crew: re-verified the supersession finding independently on 2026-08-25 before driving: main's _fetch_feed_bytes (src/kiro_crew/dashboard/handlers/updates.py:806) already reads the feed via read_capped_response(resp, _FEED_MAX_BYTES) from #4858 (merged 2026-08-22), and src/kiro_crew/net_utils.py does not exist on main — so a rebase leaves only a zero-caller duplicate helper, no behavior change. Not pushing; added the needs-human label. Recommended resolution remains: close as superseded by #4858 (with thanks to @ChickenisLegit — the fix shipped, just via a parallel PR).

[iamwhatever]

Closing as superseded by #4858, which landed the same bounded-read fix at the same call site (_fetch_feed_bytes now uses the shared read_capped_response helper, with tests) about 14 hours after this PR was opened.

Thank you @ChickenisLegit — your diagnosis and fix were exactly right; the behavior you implemented is what main now ships. The extraction into a shared helper was a clean approach too, it just landed via a parallel PR first. If you'd like to consolidate the helper further (e.g. promoting read_capped_response out of dashboard/handlers/_shared.py into a top-level module), that would make a good separate refactor issue. We'd be glad to see more contributions from you!

[ChickenisLegit]

67 67 67