3 unattended release/observability scripts have no fetch timeout, unlike sibling scripts

[JSONbored]

Context

Three unattended, CI-workflow-driven scripts make outbound fetches with no per-request timeout, unlike sibling scripts in the same release/observability-automation family which already guard against a hung connection blocking their job indefinitely:

• scripts/check-mcp-release-due.mjs:136-152's githubRequest() (runs via .github/workflows/mcp-release-watch.yml) — no AbortSignal/timeout on its fetch call to api.github.com.
• scripts/smoke-observability-traces.mjs:48,57 — both the initial trace-push fetch and the polling fetch have no per-call timeout; the script's own OBSERVABILITY_SMOKE_TIMEOUT_MS deadline is only checked between polling loop iterations, not enforced on an individual fetch call, so a single hung request can still block past the intended deadline.
• scripts/smoke-observability-metrics.mjs:47,56,63 — the same pattern, same gap.

Sibling scripts already establish two precedents for this: scripts/smoke-production.mjs:121-133's fetchWithTimeout (an AbortController + setTimeout(() => controller.abort(), 20_000) wrapper) and scripts/check-ui-mcp-version-copy.mjs:249-251's request.setTimeout(8000).

Requirements

• Add a bounded timeout to check-mcp-release-due.mjs's githubRequest() fetch, following smoke-production.mjs's fetchWithTimeout pattern (or an equivalent AbortController wrapper).
• Add a bounded per-call timeout to both fetches in smoke-observability-traces.mjs and both/all fetches in smoke-observability-metrics.mjs, so a single hung request can't exceed the scripts' own intended OBSERVABILITY_SMOKE_TIMEOUT_MS deadline.
• Each script's existing error-reporting behavior on failure should stay intact — a timeout should surface as the same kind of failure the script already reports for a non-timeout network error, not a new unhandled crash.

Deliverables

• check-mcp-release-due.mjs's githubRequest() has a per-request timeout
• smoke-observability-traces.mjs's fetches have per-request timeouts
• smoke-observability-metrics.mjs's fetches have per-request timeouts
• Test(s) simulating a never-resolving fetch for at least one of the three scripts, asserting it fails within the bounded time instead of hanging

Test Coverage Requirements

99%+ Codecov patch coverage on every changed line and branch, plus the regression test above. Confirm whether scripts/** is inside this repo's Codecov coverage.include for these specific files before assuming the gate applies identically to all three.

Expected Outcome

None of these three unattended CI scripts can hang indefinitely on a stalled network response — each fails within a bounded time and reports the failure the same way it already reports other network errors.

Links & Resources

scripts/smoke-production.mjs:121-133 (fetchWithTimeout) and scripts/check-ui-mcp-version-copy.mjs:249-251 — the two existing timeout precedents to follow. scripts/check-mcp-release-due.mjs:136-152, scripts/smoke-observability-traces.mjs:48,57, scripts/smoke-observability-metrics.mjs:47,56,63 — the three files to fix.

[linear-code]

JSO-4772