fix(preflight): cap COSI read with 2s timeout

Address review feedback from gemini-code-assist on
pkg/commands/preflight.go:21,85: the pre-flight COSI read had no
timeout, so a slow or unresponsive node could turn an informational
best-effort check into a blocker for apply. Wrap the safe.StateGet
call with context.WithTimeout (2s) inside cosiVersionReader. The
timeout is short enough to stay invisible on a healthy node and long
enough to clear any expected roundtrip; on a hung node, the reader
returns ok=false and the existing silent-on-error contract takes over.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

Author: lexfrei

pkg/commands/preflight.go

@@ -19,6 +19,7 @@ import (
 	"fmt"
 	"io"
 	"strings"
+	"time"
 
 	"github.com/cockroachdb/errors"
 	"github.com/cosi-project/runtime/pkg/resource"
@@ -29,6 +30,13 @@ import (
 	"github.com/siderolabs/talos/pkg/machinery/resources/runtime"
 )
 
+// preflightCOSIReadTimeout caps the COSI read latency so a slow or
+// unresponsive node cannot turn a best-effort informational check into a
+// blocker for `apply`. Two seconds is comfortably above any expected
+// roundtrip on a healthy node and short enough to be unnoticeable when the
+// read actually fails.
+const preflightCOSIReadTimeout = 2 * time.Second
+
 // preflightVersionMismatchHint is the hint attached to the warning when the
 // configured talosVersion contract is newer than the version reported by the
 // node. It does not name a specific Talos version — the warning line itself
@@ -74,6 +82,9 @@ type versionReader func(ctx context.Context) (version string, ok bool)
 // proxy error) is reported as ok=false.
 func cosiVersionReader(c *client.Client) versionReader {
 	return func(ctx context.Context) (string, bool) {
+		ctx, cancel := context.WithTimeout(ctx, preflightCOSIReadTimeout)
+		defer cancel()
+
 		res, err := safe.StateGet[*runtime.Version](
 			ctx,
 			c.COSI,