fix: reject incomplete streaming transcriptions

[ch-z-hc]

Bug

mmx speech transcribe --stream exits successfully when the response ends before finish=true. It only warns on stderr; JSON mode also prints the partial transcript in the normal success shape. A script checking the exit status can therefore accept an incomplete transcript as complete.

The transcription API specifies finish=true as the terminating event. The SDK already rejects an early end; this fixes the CLI path. Open streaming fixes #263 and #266 cover text generation and speech synthesis, not transcription.

Fix

Raise CLIError with exit code 1 after the existing response cleanup if no final event was received. Keep already-streamed text and its trailing newline; do not emit a successful JSON result for an incomplete stream. Completed and non-streaming responses are unchanged. No new dependency or public API.

Validation

• Four regressions: EOF / [DONE], each with text / JSON output. Unchanged production code: 18 passed / 4 failed in the transcription command module. Fixed command, speech SDK and SSE parser: 62 passed.
• Real CLI with a loopback multipart/SSE fixture: original code exits 0 for all four truncated cases; patched code exits 1. Both successful controls exit 0. The production CLI build passes the same six scenarios. No live model calls.
• Two independent automated blind reviews: no findings. One additionally checked open response-body cancellation and reader-lock release in four cases.
• Windows and Linux typecheck, lint and CLI/SDK/declaration build pass; lint retains one existing speech-test explicit-any warning.
• Full Linux suite: 599 passed / 3 failed. Independent unchanged main: 596 passed / the same 3 failed (two unreachable-region timeout cases and the FileSDK upload base-URL assertion). Those unrelated failures were not diagnosed or changed; the full suite is not green.

Full-suite validation uses temporary configuration, a process-local no-op URL opener and a validation-only fetch preload rejecting external hosts by default (test-owned mocks may override it). The full Windows OAuth suite was not run because of its existing browser-opening mock issue. No timeouts, assertions or existing skip conditions were relaxed.

Implemented and tested with Codex assistance. Blind reviews are automated, not human approval.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}