BE-013 HIGH: wire.js child/fd lifecycle on error — push() finally leaks stdin → reap HANGS; curl siblings leak

Three spawn-lifecycle holes in shared/wire.js where a throw on the happy path leaks the child's fds and can deadlock the blocking reap:

push():642 — the finally closes only rfd then io.reap(pid); wfd is closed IN-try at :639, so a throw in drainRecvAdvert/writeAll BEFORE it leaves git-receive-pack blocked reading commands on its still-open stdin. FILEReap is an unconditional blocking waitpid loop (dog/abc/FILE.c:303) → be put --force over ssh HANGS forever, plus fd/zombie leak in the resident loop. Reachable via verbs/put/put.js:310. JS-076 fixed only wire.fetch; JS-100 only pushSession/pushRemote — push() is the untouched sibling.
curlRun():181 — no try/finally: a handler throw or the guard path leaks/zombies the curl child, and reap precedes the fd close.
curlPost():198 — stages the request body OUTSIDE the try: a write failure leaks the fd and the tmp file; the tmp name is predictable.

From the 2026-07-07 be/ review (BE/REVIEW), all three CONFIRMED (push() structural, curl by inspection). Method Issues.

Input

push():642 finally { try{io.close(rfd)}catch; try{io.reap(pid)}catch } — wfd absent; the peer never sees EOF on stdin so waitpid never returns.
Canonical shape (abc resource lifecycle): a single try/finally owning EVERY fd + the reap, wfd closed FIRST so the child sees EOF, reap AFTER all closes.

push(): close wfd in the finally (before rfd/reap) on every path so the peer gets EOF; no hang, no leak.
curlRun/curlPost: try/finally owning the child + fds + tmp file; body staged inside; unpredictable tmp name (mkstemp-style).

Repro-first where feasible: a forced mid-session receive-pack throw asserting no hang (may need a fault-injection hook); the curl leaks are inspection-verified.
Reuse the wire.fetch cleanup shape JS-076/JS-100 already landed.