T1 — zcode-protocol: release AbortSignal listener on request timeout

[ChHsiching]

T1 — zcode-protocol: release the AbortSignal listener on request timeout

Parent: spec #26 (.scratch/pr139-review/spec.md)
Status: ready-for-agent
Blocked by: None — can start immediately.

What to build

The per-request timeout path in the ZCode app-server protocol client must
release its AbortSignal listener when it fires, so a long-lived AbortController
does not accumulate listeners across timed-out RPCs and a late abort after a
timeout is a silent no-op. Today the timeout callback does pending.delete +
reject but skips the cleanup() that the success/error/abort paths all call —
so the listener stays attached until the signal is GC'd. The fix makes the
timeout path match the others and match the callback's own doc-comment (which
already says cleanup "runs on response/timeout/close").

Acceptance criteria

• The request-timeout callback calls cleanup() (the existing helper that
  calls signal.removeEventListener("abort", onAbort)) before
  pending.delete + reject.
• A unit test proves the listener is removed on timeout: a request() with
  an AbortSignal and fake timers; after the timeout fires,
  signal.removeEventListener was called with "abort", and a late
  controller.abort() does not throw or double-reject.
• All existing protocol tests stay green (no double-settle, no unhandled
  rejection — attach a .catch up front, mirroring the sibling "rejects
  after timeoutMs" test, so the timeout rejection is never briefly unhandled).

Blocked by

• None — can start immediately.