fix(review): bound fetchShotContentBlock's screenshot fetch with a timeout

src/review/visual/capture.ts

@@ -127,7 +127,9 @@ export function hasSuccessfulBotCapture(routes: readonly CaptureRoute[]): boolea
  */
 export async function fetchShotContentBlock(url: string): Promise<AiContentBlock | undefined> {
   try {
-    const response = await fetch(url);
+    // Bound the fetch like every other external screenshot call in this file (#7070) -- resolveShotUrl below
+    // already uses this same timeout; a TimeoutError rejection is caught by the surrounding catch.
+    const response = await fetch(url, { signal: AbortSignal.timeout(EXTERNAL_SCREENSHOT_FETCH_TIMEOUT_MS) });
     if (!response.ok) return undefined;
     const bytes = new Uint8Array(await response.arrayBuffer());
     return { type: "image", data: base64Encode(await downscaleForVision(bytes)), mimeType: "image/png" };

test/unit/visual-capture.test.ts

@@ -2171,6 +2171,17 @@ describe("fetchShotContentBlock (#4111)", () => {
     vi.stubGlobal("fetch", vi.fn(async () => { throw new Error("network down"); }));
     await expect(fetchShotContentBlock("https://x/loopover/shot?key=broken")).resolves.toBeUndefined();
   });
+
+  it("bounds the fetch with an AbortSignal timeout (#7070)", async () => {
+    const fetchMock = vi.fn(
+      async (_url: string, _init?: RequestInit) => new Response(new Uint8Array([137, 80, 78, 71]), { status: 200 }),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+    await fetchShotContentBlock("https://x/loopover/shot?key=timed");
+    // Mirrors resolveShotUrl's own bounded fetch in this file -- an unresponsive shot host can't hang the call.
+    const init = fetchMock.mock.calls[0]?.[1];
+    expect(init?.signal).toBeInstanceOf(AbortSignal);
+  });
 });