[jinxiao]

Issue

Closes #25

Summary

A custom signer returning the input request or a clone could have its upload body closed as soon as the base RoundTrip returned. The base transport can legally finish reading afterward, so asynchronous uploads failed.

Transfer cleanup to the signed body's Close after handoff, sharing idempotent closure for input-body aliases. Signing failures still close the input; empty signed bodies preserve net/http framing. Document the resulting body lifetime.

Testing

• CGO_ENABLED=0 go test ./signer/... -run TestTransportBodyHandoff -count=1: all four new identity/clone success/error cases failed before the fix, reproducing the premature close.
• CGO_ENABLED=0 uv run --no-project python tools/modules.py check --only signer: passed packaged tests, vet, tidy verification, and an independent consumer build after the fix.
• Regression coverage includes distinct signed/input bodies, empty signed bodies, nil signed requests, and existing configuration/signing failures.
• No cloud AWS tests. Local Docker's Linux engine is unavailable; required native Linux PR CI will run before merge.

Risks and compatibility

The public API is unchanged. Input cleanup after successful handoff now follows the base transport's body closure; custom RoundTrippers must honor Go's existing obligation to close request bodies, including on error. Standalone Sign ownership is unchanged.

Release notes

• signer | fix | Preserve request bodies until the base transport finishes asynchronous uploads when custom signers share the input body.

Checklist

• The issue records the scope and acceptance criteria
• Tests and documentation match the change, or I explained why they are not applicable
• I kept CGO disabled and did not run cloud AWS tests without authorization
• I excluded credentials, personal configuration, and generated build artifacts