fix(demo): bound all curl calls in first-boot-demo and showcase

[0xacee]

Why this matters

ods/scripts/first-boot-demo.sh and ods/scripts/showcase.sh are the first-run showcase a new ODS user sees. Every one of their curl calls ran with no connection or total timeout — 7 sites in first-boot-demo, 4 in showcase. A service that accepts TCP but never answers (wedged listener, firewall DROP rule, stalled SSE stream, misconfigured port forward) makes curl wait indefinitely, freezing the demo with no error and no way forward short of Ctrl+C. The neighboring ods-preflight.sh and health-check.sh already bound every probe; the demo scripts were the remaining unbounded operational surface.

What changed

Two flag arrays, defined once per script next to the URL config:

CURL_PROBE_FLAGS=(--connect-timeout 3 --max-time 10)   # same as ods-preflight.sh
CURL_GEN_FLAGS=(--connect-timeout 5 --max-time 300)    # generous ceiling for slow inference

• first-boot-demo.sh: check_service() + Whisper/Piper/n8n probes use CURL_PROBE_FLAGS; the chat, code-assistant, and streaming completions use CURL_GEN_FLAGS. The streaming call keeps -sN and its pipe — --max-time bounds a stalled stream rather than changing its semantics.
• showcase.sh: check_service() uses CURL_PROBE_FLAGS; all three chat-completions calls use CURL_GEN_FLAGS.

No endpoint, parsing, UX, or success-reporting changes — timeout bounding only.

Regression test

ods/tests/test-demo-curl-bounds.sh stubs curl on PATH: the stub logs its argv and sleeps 30 s when --max-time is absent, simulating a wedged peer. Both scripts are then driven end-to-end under a 20 s outer timeout (first-boot-demo.sh --quick; showcase.sh via a scripted menu session covering the chat, RAG, and code-assistant POSTs), followed by a static sweep asserting every curl call site references a bounds array.

• Red on upstream/public-beta (4d725ee95): both scripts stall on their first unbounded call (exit 124); the sweep reports 7 + 4 unbounded sites. 1 passed, 7 failed.
• Green on this branch: 8 passed, 0 failed — 8 recorded calls in first-boot-demo, all 3 completion paths in showcase, all bounded.

Validation

• bash -n both scripts: clean
• shellcheck -S error on both scripts + the test: clean
• git diff --check: clean

Overlap check

Searched open/closed PRs for demo curl timeout, showcase, first-boot. Neighbors verified disjoint:

• fix(demo): verify streaming output in first-boot-demo before claiming success #5849 (verify streaming output), fix(demo): verify streaming completion before reporting success #4916 — streaming success reporting, not timeouts; composes cleanly.
• fix(showcase): correct API endpoints and stop aborting demo on request failure #5851 — showcase endpoint correction; touches URL paths, not flags.
• fix(demo-offline): handle EOF cleanly during menu and pause prompts #5869, fix(first-boot): recover malformed saved wizard progress #5529, Retain the first-boot owner card until completion succeeds #5527 — EOF handling / wizard progress.
• Use ANSI-C quoting for color escape sequences in first-boot-demo.sh #5419, Use ANSI-C quoting for color escape sequences in showcase.sh #5422 — ANSI quoting; fix(showcase): avoid clobbering SCRIPT_DIR in parent environment #3078 — SCRIPT_DIR clobber.
• feat(demo): add service-only health snapshot #2629 — health-snapshot feature.

None bound the existing call sites.

Notes

• Live end-to-end validation against real services is pending CI/maintainer run; the stub harness exercises the same argv boundary curl sees.
• The --max-time 300 generation ceiling is intentionally generous (CPU inference on large models); it bounds hangs, not slow responses.