v2.1.0 — the JSON path gets the ceiling the log download already had

Part of RT #1601's sweep — and the repo that proves the constitution check is a tripwire rather than a proof.

It passed the bounded-read signal, because _download_job_log has always read in bounded pieces. The JSON path that every other tool goes through had a content-length check and nothing else: one of two read paths streamed, so the repo looked done. The check's docstring names this as its second false pass; this is the repo it names.

Fixed

• The JSON path now streams too, measured before each chunk is copied in. aiter_bytes() promises nothing about chunk size — one chunk can be the whole body — so appending first would copy in exactly the response being refused.
• An error that is not GitHub's JSON shape says what it was. It arrived as Unknown error, or 200 bare characters of body with no indication of where they came from, so an Enterprise login page, a proxy error and the API refusing something were one message. Such a body is now quoted, bounded, alongside the method, URL, status and content-type. GitHub's own message is still used verbatim, now length-bounded.
• The URL in an error carries no secret. Userinfo is dropped, and access_token — GitHub's own retired query-string auth — with client_secret, code and token are redacted by name. By name, because per_page, state and sha are the diagnosis.

Added

• The client says what it is. GitHub asks API clients to send a User-Agent, and httpx's default python-httpx/<version> is what bot protection answers with a challenge page (RT #1596).

Changed

• Inherits constitution v1.36.0.