fix: do not await the release on a cancellation path (#2319 round 25)

`ReadableStream.cancel()` adopts the underlying source's cancel promise,
which is permitted never to settle — so awaiting `releaseBody` while
propagating a cancellation can hang the very thing it was meant to end.
The five exceptional exits in the compat probe loop now start the
release without waiting on it: the release is a courtesy to the
connection pool, and the caller's abort or timeout must reach it
regardless. The two non-exceptional awaits are unchanged.

Same class as the tee teardown in round 24, one file over.

Also moves the `redactUrlQuery` import above
DEFAULT_OAUTH_REQUEST_TIMEOUT_MS's JSDoc, which it had split from the
constant — so hover and API tooling see the doc again.

Verified by mutation: awaiting the release makes the new test time out.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YFnM6RqB4nXqNysgUYmjmq
Signed-off-by: cliffhall <cliff@futurescale.com>

core/auth/requestTimeout.ts

@@ -56,6 +56,8 @@
  * shape, as `revokeToken`.
  */
 
+import { redactUrlQuery } from "../mcp/fetchTracking.js";
+
 /**
  * 30 seconds. Deliberately generous: discovery against a slow or cold-starting
  * authorization server is legitimate, and a bound that fires on a server that
@@ -63,8 +65,6 @@
  * halves the 60s the SDK handshake incidentally provides, and it is the only
  * bound at all on the legs that sit outside an SDK request.
  */
-import { redactUrlQuery } from "../mcp/fetchTracking.js";
-
 export const DEFAULT_OAUTH_REQUEST_TIMEOUT_MS = 30_000;
 
 /**