fix: enforce semantic idle timeout for Build streams

[MMortise]

Summary

• enforce the Grok Build stream idle timeout based on useful generated SSE deltas instead of raw transport bytes
• ignore SSE comments, keepalives, lifecycle/control events, doom-loop checks, and empty deltas when refreshing the deadline
• apply the same protection to regular Responses streams and the forced-SSE gateway compaction path
• wire the existing Build stream idle setting into adapter startup and hot reload

Root cause

The transport-level timeout introduced by #871 resets after every successful body read. Grok Build can keep sending keepalive comments and private control events without producing a token, so a stream configured for a one-minute idle timeout could remain alive until the upstream closed it around ten minutes later.

The new wrapper observes SSE framing without changing response bytes. It closes the underlying response body and surfaces upstream_stream_idle_timeout when no non-empty generated delta arrives within the configured window.

Verification

• go test ./...
• go test -race ./internal/infra/provider/cli
• semantic timeout and compaction regressions repeated 10 times
• git diff --check