fix(scripts): bound gh read error bodies

test/scripts/gh-read.test.ts

@@ -5,6 +5,7 @@ import {
   normalizeRepo,
   parsePermissionKeys,
   parseRepoArg,
+  readBoundedGitHubErrorText,
   resolveGitHubFetchTimeoutMs,
 } from "../../scripts/gh-read.js";
 
@@ -80,6 +81,19 @@ describe("gh-read helpers", () => {
     await expect(request).rejects.toThrow(/GitHub API GET \/app\/installations exceeded timeout/u);
   });
 
+  it("bounds GitHub API error response bodies", async () => {
+    const tail = "tail-sentinel-should-not-appear";
+    const response = new Response(`${"x".repeat(5000)}${tail}`, {
+      status: 500,
+    });
+
+    const text = await readBoundedGitHubErrorText(response);
+
+    expect(text).toContain("[truncated]");
+    expect(text).not.toContain(tail);
+    expect(text.length).toBeLessThan(4200);
+  });
+
   it("rejects invalid GitHub API timeout values", () => {
     expect(resolveGitHubFetchTimeoutMs("1000")).toBe(1000);
     expect(() => resolveGitHubFetchTimeoutMs("1s")).toThrow(