fix: close serveDemo stdout pipe on read failure

Addresses docker-agent review on #14258 (discussion_r4092089046):
when ReadString fails after Start() succeeds, the pipe read-end was
leaked -- nothing else calls Wait() on this deliberately long-lived
subprocess. Mirrors the existing close on the Start() failure path.

Signed-off-by: Nicolas De Loof <[email protected]>

docs/examples/provider.go

@@ -265,6 +265,9 @@ func serveDemo(bindAddr string) (string, error) {
 	addr, err := bufio.NewReader(stdout).ReadString('\n')
 	watchdog.Stop()
 	if err != nil {
+		// the subprocess outlives this function so nothing else calls
+		// Wait() to close the pipe's read end: release it here
+		_ = stdout.Close()
 		return "", fmt.Errorf("bind %s: endpoint did not come up: %w", bindAddr, err)
 	}
 	return addr, nil