fix(installer): bound services progress-bar kubectl with --request-timeout

[saadqbal]

Summary

Bugbot Medium on #345: _download_services_progress (scripts/lib/install-client-helm.sh) is documented as bounded/non-blocking, but its two kubectl get pods calls omitted --request-timeout. Since the TB_PULL_TIMEOUT deadline is only checked between iterations, a wedged or unreachable API makes kubectl block indefinitely — freezing step e's progress bar before the authoritative readiness gate in step f ever runs.

Fix

Add --request-timeout (default 5s, overridable via TB_PROGRESS_KUBECTL_TIMEOUT) to both kubectl get pods calls, mirroring assess.sh's bounded probe. A call that can't reach the API now returns quickly, the loop re-checks the deadline, and step e degrades to the honest "still downloading in the background" line instead of hanging.

Test plan

• shellcheck --severity=error scripts/lib/install-client-helm.sh → clean
• bats scripts/tests/install-client-helm.bats → 53 pass (the one pre-existing _extract_yaml_value '' escape failure is unrelated and also fails on develop); the progress fn is skipped in bats via TB_NO_SERVICE_PROGRESS, so behavior there is unchanged
• scripts/gen-manifest.sh --check → up to date

Checklist

• No secrets / credentials in the diff

🤖 Generated with Claude Code

---

Note

Low Risk
Small, localized installer UX fix with no auth, data, or install-success path changes beyond avoiding a progress-bar hang.

Overview
Fixes a hang in install step e where _download_services_progress could block forever on kubectl get pods when the API is wedged or unreachable. The loop only checks TB_PULL_TIMEOUT between iterations, so unbounded kubectl calls ignored that deadline.

Both pod-list probes now use --request-timeout (default 5s, override via TB_PROGRESS_KUBECTL_TIMEOUT), matching the bounded kubectl pattern in assess.sh. Failed or slow API calls return quickly; the bar can time out and show the “still downloading in the background” path instead of freezing before step f’s readiness gate. The script manifest checksum is updated for the changed installer lib.

^{Reviewed by Cursor Bugbot for commit b7fb5fa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 48 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#182 — feat(weights): averaging writes SafeTensors (TF + PyTorch) — SEC-03 §8 step 4 · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#183 — docs: SafeTensors deployment-order & resume-safety runbook (epic ci: drop push-tags trigger from release-helm-chart.yaml to fix race with release-published #116) · author: @shujaatTracebloc · reviewer: @saadqbal
• backend#1093 — chore(deps): bump django from 5.2.14 to 5.2.15 · author: @dependabot · no reviewer assigned
• backend#1108 — test(api): CLI response-shape contract fixtures for the 9 CLI endpoints (WS-D.2) · author: @LukasWodka · reviewer: @saadqbal
• backend#1111 — feat(download): edge weights fetch tolerates .safetensors (SEC-03 step 5c hardening) · author: @shujaatTracebloc · reviewer: @saadqbal
• backend#1112 — fix(runners): migrate deprecated trainingClasses/getTrainingPlan to snake_case (#1102) · author: @LukasWodka · reviewer: @saqlainsyed007
• backend#1114 — perf(leaderboard): serializer prefetch reads + TeamSerializer is_* in Python (#978 pt2) · author: @aptracebloc · reviewer: @saqlainsyed007
• cli#302 — ci: re-enable staticcheck (pinned standalone) + fix the 5 non-ST1005 findings · author: @LukasWodka · no reviewer assigned
• cli#306 — test: SwapSeam helper + advisory gremlins mutation workflow · author: @LukasWodka · no reviewer assigned
• cli#307 — docs: truth pass — README/nav-map/checklist match the v0.8 surface + release policy · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)