[Code Quality] Add HTTP server timeouts to bootstrap_profile_github_app.go

[github-actions]

Description

The OAuth callback HTTP server in pkg/cli/bootstrap_profile_github_app.go:208 is created with zero timeouts (ReadHeaderTimeout, ReadTimeout, WriteTimeout all absent). A misbehaving or slow OAuth callback client can pin a goroutine for the full bootstrapProfileManifestTimeout duration, exhausting resources.

The MCP HTTP server in pkg/cli/mcp_server_http.go already sets ReadHeaderTimeout as a reference implementation.

Suggested Changes

• Add ReadHeaderTimeout, ReadTimeout, and WriteTimeout to the http.Server struct in bootstrap_profile_github_app.go
• Use short, appropriate timeouts matching the OAuth flow (e.g. 30s read, 30s write)
• Also add IdleTimeout to mcp_server_http.go to reclaim idle keep-alive connections

Files Affected

• pkg/cli/bootstrap_profile_github_app.go (line 208)
• pkg/cli/mcp_server_http.go (line 98) — add IdleTimeout

Success Criteria

• Both HTTP servers have at minimum ReadHeaderTimeout and WriteTimeout configured
• MCP server has IdleTimeout set
• All existing tests pass
• No change to observable behavior under normal OAuth flow

Priority

Medium — server is loopback-only but still subject to slow-client abuse

Source

Extracted from Repository Quality Improvement Report - Goroutine Lifecycle Hygiene #47586

🔍 Task mining by Discussion Task Miner - Code Quality Improvement Agent · sonnet46 · 42.2 AIC · ⌖ 5.29 AIC · ⊞ 7.1K · ◷

• expires on Jul 24, 2026, 11:12 AM UTC-08:00