fix(hub): close seven bugs found in the refactor review

The PermissionRequest hook posted asks cut to the hub's field limits, so a signature covered less than Claude Code would run; it now posts nothing it cannot sign in full and leaves the decision to Claude Code with a reason on stderr. fields.seconds names the field the caller used in its error. Serving a stored page maps an OSError to 500 instead of a dropped connection. The natural-language line marks the register as seen before it builds the inbox, like the page does. do_POST runs every header guard (host, origin, client, content type, MCP) before it reads the body, so a refused request never costs its upload. The runner's reader closes stdout at EOF, because a close from the executing thread blocked on the buffer lock and could SIGPIPE a command still running. The page title counts only inbox items that are not snoozed.

Committed on the operator's word despite the gate: cost and time are estimates under 98 % other load and include eight new test cases.

🎯 Fix: 88 %
💥 Break: 3 %
💸 Cost: 106 %
⏱️ Time: 113 %
🛡️ Security: 100 %
🏆 Score: 71
🚦 Gate: ⛔ fix 88 % < 90; cost 106 % > 100, time 113 % > 100: ask the operator before the commit

```
/home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub
```

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_hub_page.py

@@ -1,10 +1,13 @@
 from __future__ import annotations
 
+import errno
 import json
 import re
 import subprocess
 import time
 import unittest
+from pathlib import Path
+from unittest import mock
 
 from hub_case import HubCase
 from hub_support import AMBIENCE, SPACE, VOICE
@@ -36,6 +39,13 @@ class TestHubPage(HubCase):
         self.assertEqual((status, headers["content-type"]), (200, "application/json"))
         self.assertEqual(headers["content-security-policy"], exchange.PLAIN_CSP)
 
+    def test_a_stored_file_that_cannot_be_read_answers_500(self):
+        review_id = self.request("feat: io", "")
+        for name in ("page", "files"):
+            with self.subTest(name=name), mock.patch.object(Path, "read_bytes", side_effect=OSError(errno.EIO, "Input/output error")):
+                status, _, body = self.get(f"/reviews/{review_id}/{name}")
+                self.assertEqual((status, body), (500, b"storage failed: Input/output error\n"))
+
     def test_markup_from_agents_is_escaped(self):
         self.request("<script>alert(1)</script>", "</pre><script>alert(2)</script>")
         register = {"work/x": {"title": "<script>alert(3)</script>", "status": "running", "roles": {"<b>One</b>": "RA"}}}