fix: release SDK-owned SSE response bodies

[dvd233]

Fixes #277

Summary

Add cleanup to Client.streamSSE so that, after the parser releases its reader, the SDK cancels its response body when iteration exits. This releases still-open responses after [DONE], consumer break/return, or parsing errors. Cancellation failures preserve the existing result/error.

Standalone parseSSE ownership, SSE/CRLF parsing, normal EOF behavior, and public signatures stay unchanged. Regression tests also cover existing transcription cleanup without duplicate underlying cancellation.

Only src/sdk/client.ts and test/sdk/stream-cleanup.test.ts change. The validation workflow and harness remain on a separate fork-only branch.

Validation

• New real-SDK-path tests: 10 failures and 10 passing controls on the unchanged base; all 20 pass with the fix.
• Full native suite: 612 pass. Typecheck, lint, production/declaration and development builds, and compiled CLI smoke pass. Lint retains one existing warning.
• Source-bound fork validation checks out feature commit da978118b8accb38e007582a8a226ab833bafaad. SDK lifecycle and loopback connection-close probes pass on Node 18.20.8 and Node 24.

The full suite uses an offline fetch guard allowing loopback fixtures and blocking external requests/redirects. In-memory probes also run under a socket-denial guard. All credentials/audio are synthetic; no live provider requests were made.

Scope

Cleanup applies after shared SSE iteration starts. Queued return() still waits for a pending next(); never-started generators and text content-type rejection before shared parsing remain unchanged.

AI assistance was used for implementation, tests, and automated review.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}