fix(hub): close seven bugs found in the refactor review

The PermissionRequest hook posted asks cut to the hub's field limits, so a signature covered less than Claude Code would run; it now posts nothing it cannot sign in full and leaves the decision to Claude Code with a reason on stderr. fields.seconds names the field the caller used in its error. Serving a stored page maps an OSError to 500 instead of a dropped connection. The natural-language line marks the register as seen before it builds the inbox, like the page does. do_POST runs every header guard (host, origin, client, content type, MCP) before it reads the body, so a refused request never costs its upload. The runner's reader closes stdout at EOF, because a close from the executing thread blocked on the buffer lock and could SIGPIPE a command still running. The page title counts only inbox items that are not snoozed.

Committed on the operator's word despite the gate: cost and time are estimates under 98 % other load and include eight new test cases.

🎯 Fix: 88 %
💥 Break: 3 %
💸 Cost: 106 %
⏱️ Time: 113 %
🛡️ Security: 100 %
🏆 Score: 71
🚦 Gate: ⛔ fix 88 % < 90; cost 106 % > 100, time 113 % > 100: ask the operator before the commit

```
/home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub
```

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_hub_executors.py

@@ -103,6 +103,21 @@ class TestHubExecutors(HubCase):
         self.assertEqual(runner.execute({"command": "exit 3", "directory": str(self.outside)}, reports.append), 3)
         self.assertEqual(reports[-1], {"output": "", "code": 3, "refused": False})
 
+    def test_the_runner_closes_the_output_pipe_on_every_path(self):
+        popen, spawned = subprocess.Popen, []
+        job = {"command": "echo hi; sleep 0.3", "directory": str(self.outside)}
+
+        def spawn(*args: object, **kwargs: object) -> subprocess.Popen:
+            spawned.append(popen(*args, **kwargs))
+            return spawned[-1]
+
+        with mock.patch.object(subprocess, "Popen", spawn), mock.patch.object(runner, "BEAT", 0.05):
+            self.assertEqual(runner.execute(job, [].append), 0)
+            self.assertTrue(spawned[0].stdout.closed)
+            self.assertRaises(RuntimeError, runner.execute, job, mock.Mock(side_effect=RuntimeError("the hub is gone")))
+        self.settle(lambda: spawned[1].stdout.closed)
+        self.assertEqual(spawned[1].wait(10), 0)
+
     def test_rules_are_signed_once_and_checked_by_the_executor(self):
         now = time.time()
         rule = {"kind": "ask", "tool": "Bash", "pattern": "make *", "scope": "/repo*", "expires": now + 3600}