fix(hooks): close stdin when EOF timeout expires

[ydflow]

Summary

hook-dispatch returns from its stdin read after 1 second when a host does not send EOF, but the pending for await (process.stdin) loop remains attached. An open host pipe can keep the process alive after dispatch finishes, defeating the bounded read.

Destroy the stdin stream only when the EOF deadline wins. Normal EOF and TTY paths remain unchanged. The regression test verifies that the buffered payload is returned and the timed-out pipe is closed.

Validation

• npx vitest run src/__tests__/hook-dispatch-cli.test.ts -t "closes a pipe" — passed (1 test).
• npm run typecheck — passed.
• npm run lint — passed.
• npm run build — passed.
• Real CLI E2E: wrote {} to node dist/index.js hook-dispatch stdin-timeout-probe --tool claude, kept the parent pipe open, and the CLI exited with code 0 in 1.9 seconds.
• The full hook-dispatch-cli.test.ts run on this Windows host reported 18 passed and 2 timeouts in the existing hookDispatchCli tests that wait for a mocked PowerShell/WMI close event; the new stdin timeout regression test passed.

[github-actions]

No findings.

The PR description includes sufficient testing for this runtime behavior change, including a representative real-CLI E2E result.