fix: close HTTP response body explicitly instead of defer inside loop (resource leak)

[amathxbt]

Problem

In cli/api.go, inside the for _, checkURI := range uris loop, each iteration uses:

defer resp.Body.Close()  // runs when Load() returns, NOT at end of loop iteration
body, err := io.ReadAll(resp.Body)

defer in Go runs when the enclosing function returns, not when the loop iteration ends. With N URI candidates (service-desc, describedby, loader hints, entrypoint), N response bodies stay open simultaneously until Load() exits, holding N HTTP connections from the transport pool. Under connection limits or slow networks this causes pool exhaustion and hard-to-reproduce hangs.

The DecodeResponse error branch also leaks — body is never closed on early return.

Fix

• Remove defer resp.Body.Close()
• Call resp.Body.Close() immediately after io.ReadAll (bytes fully consumed, safe to close)
• Also close in the DecodeResponse error branch to prevent leaking on early return

References

• https://pkg.go.dev/net/http#Response — caller is always responsible for closing Body
• Effective Go: defer triggers at function return, not block exit

[amathxbt]

Hey @akasuv @HappySean2845 @hughzhou-gif @ZhimaoL, flagging this one for the team. The defer inside the loop is easy to miss but it means connections are not being released between iterations. Most of the time it is fine but under any kind of network pressure or connection limit it will start causing hangs that are hard to trace back to this. Worth merging before it becomes a production issue.