Oversized Core response streams now return invalid_response without waiting for cancellation to settle. Cleanup rejection is handled, and reader locks are released after successful or failed reads.
Regression tests cover pending/rejected cancellation on both endpoints and reader lock release. Workspace tests: 110 passed, 3 expected Windows skips; type checks and Shell build passed; dependency audit 0 vulnerabilities. PR #45 and main CI passed.