Fix UnobservedTaskException from orphaned ReadLineAsync task during watch cancellation

[Copilot]

Cancelling a watch's CancellationToken while ReadLineAsync() is in flight left the original read task orphaned. When the transport tore the connection down, that task faulted with an unobserved IOException, surfacing as a TaskScheduler.UnobservedTaskException at finalization (e.g. during app shutdown).

Root cause: AttachCancellationToken in CreateWatchEventEnumerator wraps the read via task.ContinueWith(..., cancellationToken). On cancellation the continuation is cancelled immediately while the original ReadLineAsync() keeps running and later faults — with no one observing it.

Changes — src/KubernetesClient/Watcher.cs

• net7+: cancel the read directly. Pass the token to ReadLineAsync(cancellationToken), which cancels the underlying read so no task is orphaned. The AttachCancellationToken wrapper is no longer used for reads here.

  #if NET7_0_OR_GREATER
              var line = await streamReader.ReadLineAsync(cancellationToken).ConfigureAwait(false);
  #else
              var line = await AttachCancellationToken(streamReader.ReadLineAsync()).ConfigureAwait(false);
  #endif

• Older TFMs (netstandard2.0/net48 via KubernetesClient.Classic): observe the orphan. AttachCancellationToken now attaches an OnlyOnFaulted continuation that consumes the original task's exception. This also covers the streamReaderCreator() task path on all frameworks.

  _ = task.ContinueWith(
      static t => { _ = t.Exception; },
      CancellationToken.None,
      TaskContinuationOptions.OnlyOnFaulted | TaskContinuationOptions.ExecuteSynchronously,
      TaskScheduler.Default);

Tests — tests/KubernetesClient.Tests/WatchTests.cs

• Adds CancellationDoesNotLeaveUnobservedTaskException: cancels mid-read, then faults the underlying task and forces finalization, asserting no UnobservedTaskException fires. Fails against the unpatched code, passes with the fix.

Notes

• The pre-existing AsyncEnumerableWatchWithCancellation test times out in this sandbox against the baseline as well; unrelated to this change (mock Kestrel server environment limitation).

[linux-foundation-easycla]

• ❌ - login: @Copilot / name: copilot-swe-agent[bot]. The commit (2e69e3c, a3a4c9f, ee7fd35) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please visit our EasyCLA portal and chat with our support bot.

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Copilot
Once this PR has been reviewed and has the lgtm label, please ask for approval from tg123. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment