fix(safe-operations): share one fallback AbortSignal across a withBoundedParallel batch (#221)

[Jaydbrown]

Rewrite of #382 on a main-repo branch (so CI runs — the fork PR had no
checks). Same fix, same test.

Problem

withBoundedParallel (lib/safe-operations.ts) built the AbortSignal
handed to each handler as options?.signal ?? new AbortController().signal
inside the worker loop. When the caller passes no outer signal, this
allocated a fresh AbortController for every item and threw it away
immediately — nothing kept a reference to call .abort(), so
signal.aborted stayed false forever and per-item cancellation silently
never worked (#221).

Fix

Compute the fallback signal once per call, before the loop starts. Every
item in an outer-signal-less call now gets the same AbortSignal instance.
It is still not externally abortable without an API change (returning the
controller / an onAbort hook) — out of scope for this bug — but it is a
coherent shared object rather than a dead one manufactured per item.

The only real call site, components/stream/BulkWithdrawButton.tsx, always
passes its own options.signal and never reads the handler's third
parameter, so this is fully backward compatible; the handler type
(signal: AbortSignal, never undefined) is unchanged.

Test

lib/safe-operations.test.ts — new 'shares a single fallback signal across items when no outer signal is provided': three items, asserts all three
receive the exact same AbortSignal instance (the old code gave each a
distinct dead one). Existing signal tests unchanged.

Local npm install is not possible in this environment (the lockfile
registry is unreachable here), so verification is via CI on this branch.

Closes #221

[Jaydbrown]

CI here fails at the npm ci step, not on this change — main fails identically on every recent commit. package-lock.json has two pre-existing problems:

1. @conduit-protocol/sdk resolves to git+ssh://git@github.com/conduit-protocol/conduit-sdk.git — that repo was renamed to streamFi-sdk, so the install can't fetch it.
2. ~30 packages are resolved against https://registry.npmmirror.com/... (a regional mirror) instead of registry.npmjs.org, which the CI runner can't reach.

Both need a package-lock.json regeneration on main before any app PR can go green. The code change in this PR is a 1-line fix plus a regression test; the diff is small enough to review directly.

[Jaydbrown]

Root cause filed as #404.

[mhikel66]

Superseded — #382 (the original) was merged as ef1b61d, so this rewrite is now redundant and conflicts with main. Leaving it open for a maintainer to close.