fix(proxy): avoid releaseLock() racing an outstanding reader.read() on drain deadline

drainReaderWithDeadline() called reader.releaseLock() immediately after a
deadline win, discarding the still-pending reader.read() promise. Per
WHATWG Streams, releaseLock() during a pending read only rejects that JS
promise — it does not signal the underlying native source that the stream
is abandoned. On Bun's native fetch this is the "touched then abandoned"
shape that can trigger unbounded off-heap buffering (oven-sh/bun#39590),
matching the flat-JS-heap, unbounded-RSS signature reported in #382.

Now aborts first (so the losing read has a chance to actually settle via
the torn-down connection), then waits for it to settle within a bounded
grace window before releasing the lock, instead of racing ahead of it.