Adopt the SDK's response-body cap

[jeremy]

hey-sdk v0.13.0 (basecamp/hey-sdk#105) bounds its own reads: the transport NewClient builds caps JSON and HTML response bodies at hey.DefaultMaxResponseBodyBytes (16 MiB), success and error alike, decompressed, leaving blobs to the SDK's own streaming and caps. The interim RoundTripper in internal/cmd/sdk_transport.go was written to be replaced by exactly that, so it comes out.

What the SDK does that the interim cap did not is keep an oversized error response's status: the refusal arrives as the *hey.Error for the status wrapping hey.ErrResponseTooLarge. The thread loader therefore classifies a failed message read by status before size:

• an oversized 500, 429 or 401 is still the service failing — systemic, stops the fan-out
• an oversized 404 is still a missing message — failed, not over_limit
• only an oversized success marks the entry over_limit

Coverage: TestThreadsMarkAnOversizedMessageOverLimit now proves the over_limit path against the SDK's cap end to end; new internal/threadload/sdk_test.go proves the classification through a real client for the statuses the generated client answers immediately (200/401/404), and unit-tests the 429/500 shapes directly — those two would each cost seven seconds of the generated client's retry backoff through a real server, and the SDK's own body_limit tests pin that error shape.

Closes #248

---

Summary by cubic

Adopts github.com/basecamp/hey-sdk/go v0.13.0 to cap JSON/HTML response bodies at hey.DefaultMaxResponseBodyBytes (16 MiB, decompressed) and removes our interim transport. Updates thread loading to classify oversized responses by HTTP status first so we don’t mislabel errors as over_limit, and updates the Nix vendorHash.

• Behavior change: an oversized 500/429/401 is systemic (stops fan‑out); an oversized 404 is a normal “missing message”; only an oversized 2xx marks the entry over_limit. The SDK returns oversized errors as a *hey.Error with hey.ErrResponseTooLarge as the cause; internal/threadload/sdk.go now handles this via classifyMessageError.
• Review notes: drops internal/cmd/sdk_transport.go and its tests; removes custom WithTransport usage; tests now use hey.DefaultMaxResponseBodyBytes and add internal/threadload/sdk_test.go; AGENTS.md documents the cap and classification; to change the cap, use hey.WithMaxResponseBodyBytes (no opt‑out; zero/negative uses the default); updates nix/package.nix vendorHash.

^{Written for commit 43c306a. Summary will update on new commits.}

[Copilot]

Pull request overview

Adopts the SDK’s built-in response-body cap and removes the temporary CLI transport.

Changes:

• Upgrades hey-sdk to v0.13.0.
• Classifies oversized responses by HTTP status before size.
• Adds end-to-end and unit coverage for oversized responses.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
AGENTS.md	Documents SDK response limits and classification.
go.mod	Upgrades the SDK dependency.
go.sum	Updates SDK checksums.
internal/cmd/sdk.go	Removes the interim capped transport.
internal/cmd/sdk_transport.go	Deletes the superseded transport.
internal/cmd/sdk_transport_test.go	Deletes tests for the superseded transport.
internal/cmd/thread_partial_test.go	Tests the SDK’s default response limit.
internal/threadload/sdk.go	Classifies status-bearing oversized errors correctly.
internal/threadload/sdk_test.go	Covers oversized success and error responses.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.