/internal/* blocks on findRelease with no deadline, so the FIRST unfurl of a large repo hands the crawler the placeholder

[lukaso-bot]

/internal/* is the JSON endpoint web-og calls over the Service Binding to
render an OG card. Two of its exits block on findRelease with no deadline:
a cold slot, and (since #144) a prior past MAX_STALE_PINNED. Both run to core's
defaults — softDeadline ?? Date.now() + 24_000, hardDeadline ?? + 28_000
(packages/core/src/find-release.ts:81-82).

Why that hands the crawler a placeholder

Someone shares a permalink for a large repo for the first time. The slot is cold,
so findRelease runs for ~20s. web-og's env.WEB.fetch passes no
AbortSignal, so it waits. Slack/X give up on the unfurl after a few seconds,
cache the neutral placeholder, and do not re-unfurl for far longer than its
max-age=60.

Every platform's first unfurl is cold, so #144's cache-key alignment — which
fixes the second request — does not help the one the user actually sees.

The precedent is already in the repo

packages/web/src/routes/badge.ts:129-130 guards the same situation on the same
cache key:

softDeadline: Date.now() + 8_000,
hardDeadline: Date.now() + 9_000,

with the reason in its comment: "a slow repo returns a short-cached 'checking…'
instead of hanging past the proxy's fetch timeout". /internal is the more
latency-critical of the two and sets none.

Scope

Pre-existing, not a #144 regression. main's /internal calls
findRelease(input, { client }) with no deadline either (git show origin/main:packages/web/src/routes/internal.ts), so this behaves identically
before and after that PR. Raised in review of #144 and deliberately split out:
picking the deadline is a latency-policy decision with its own blast radius
(what /internal returns on a blown deadline, and what TTL web-og gives it),
in a PR that is about it rather than smuggled under a cache-key title.

Sketch of the fix

• Give /internal's blocking load() a soft/hard deadline in badge.ts's range
  (a crawler's patience is seconds, not 24 of them).
• Decide what a blown deadline returns. findRelease emits a partial on a soft
  deadline, and after fix(web): align /internal/* result cache with the public routes (#143) #144 round 7 /internal no longer serves a cached
  partial to a pinning consumer — but one produced by its own load still flows
  through, which is the web-og half tracked in OG card for a not-yet-released commit is cached 24h, so it never flips when the release lands #151. The two want deciding
  together.
• Guard it: seed a load that never settles inside the deadline and assert the
  route answers in bounded time with the short-cached shape, not a hang.