[knQzx]

limitedReadCloser only released its pull limiter slot in Close(), so any consumer that drains the body to EOF via io.Copy and treats that as done never gives the slot back. once every WithJobs slot leaks this way the next acquire blocks forever and pulls deadlock

this adds a Read override that releases the slot on the terminal read, since the wrapped verify.ReadCloser returns a non-nil error at EOF. the existing sync.Once keeps release idempotent, so the normal Close() path is unchanged and a read-to-EOF followed by Close() still releases exactly once

unlike patching individual call sites to always Close(), this also covers external consumers of remote that read a blob stream to EOF

fixes #2369

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.13%. Comparing base (0f89719) to head (11fe2b1).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2373      +/-   ##
==========================================
+ Coverage   57.11%   57.13%   +0.01%     
==========================================
  Files         166      166              
  Lines       11468    11473       +5     
==========================================
+ Hits         6550     6555       +5     
  Misses       4141     4141              
  Partials      777      777              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.