Resolve fetchSource onto main's shared deadline: one AbortSignal covers the fetchFirms request and the capped body read. The CHANGELOG entry moves to a changelog.d fragment in the next commit.