Retire the last URLSession streaming reader: /stream.avcc over a raw socket

[obj-p]

Follow-up to #350/#375 (no issue of its own — closes the last streaming consumer that shared the flake class). Coordinator-approved after #262 landed.

Why

readAVCCTags (the /stream.avcc test reader) was the last consumer on URLSession.bytes + boundedRead. That's the AsyncBytes-cancellation-trap exposure that produces the -999 face of the #350 class (the -1 buffering face was fixed for MJPEG in PR #375). Under the now-required bazel gate, a latent AsyncBytes trap intermittently reds PRs (it already bit #376's stale branch), so this closes it at the root rather than waiting for a specimen.

Change

• RawHTTP gains a streaming sibling to sample(): stream(port:path:deadline:onConnected:consume:), built on a shared openAndReadHead extracted from sample. Raw blocking socket, SO_RCVTIMEO per read + a whole-read deadline from one clock. onConnected fires just before the first body bytes (matching the old first-body-byte timing, so the driven drag still forces an IDR after the subscriber registers), and body chunks feed a stop-predicate.
• readAVCCTags uses stream, keeping its exact length-prefixed envelope parse and the octet-stream content-type assertion (now read from the returned head text).
• The elaborate continuation-race deadline machinery in boundedRead is deleted (it existed only to work around AsyncBytes being uncancellable). Net −38 lines.
• One-shot /control POSTs keep URLSession — not a streaming body, never implicated. No URLSession streaming consumers remain.

Verification

• MCPIntegrationTests 3/3 and PreviewsIOSTests 3/3 (the latter exercises the refactored sample()) across --nocache_test_results runs; full local suite 11/11 green; lint clean.
• Gates (MEDIUM): /simplify + /code-review medium, both clean — reviewers verified fd lifecycle (no double-close/leak on any path), that the onConnected keyframe timing is preserved (0x01 replay + forced-keyframe arming still land), envelope parse equivalence across chunk boundaries, and Sendable safety.

Proposed review tier: MEDIUM (test-only, but real socket/async logic + a new shared helper; bounded blast radius).

🤖 Generated with Claude Code

https://claude.ai/code/session_01D9tE6iZwyGJcX5Kx9LUnhm