fix: bound raw session ID initialize probe

[jstar0]

Fixes #428.

The raw initialize probe used to inspect MCP-Session-Id had no timeout and never released its response body. A server that accepted the connection without responding could stall the scenario, while a long-lived SSE response could keep the connection open after the header was inspected.

This change:

• bounds the probe with a 5-second AbortSignal.timeout;
• cancels the response body after reading the session header, including long-lived SSE responses;
• preserves the existing check IDs, statuses, and best-effort session termination behavior.

Verification:

• npm test
• npm run build
• npm run typecheck
• npm run lint