[uk-ai-resilience] Untracked code-scanning alert #672 in mcp_setup_generator.go (Tier B)

### Summary

UK AI Open Code Governance review (7-day recent-change scope, 2026-08-27 → 2026-09-03) identified an open CodeQL alert with no existing tracking issue — the only untracked finding among 11 open alerts.

**Alert**: `#672` — CodeQL `go/allocation-size-overflow` (severity: warning, CWE-190)
**Location**: `pkg/workflow/mcp_setup_generator.go:146`

### Tier: B — Open With Conditions

| Dimension | Rating |
|---|---|
| Exposure amplification | Low |
| Patchability | High |
| Detectability | High (CodeQL) |
| Operational fragility | Low |
| Ownership confidence | Low (no `CODEOWNERS` file assigns an owner) |

### Assessment

The flagged code performs a size computation for an allocation (`make([]...)`-style pattern) in the MCP gateway/tool setup generator. If the size is derived from a potentially large or attacker-influenced input, the computation may overflow, causing either a runtime panic (negative size) or an unexpectedly small allocation (wraparound). This function was recently touched as part of MCP gateway setup changes in the current review window, so it has not yet accumulated a tracking issue.

### Remediation action

- Guard the arithmetic with a bounds check before use in the allocation, or widen the intermediate type (e.g., use `uint64`/`int64` accumulation before converting to a slice length).
- Add a regression test exercising a large/edge-case input to confirm no panic or wraparound occurs.

**SLA urgency:** high

### Discussion report

See the "UK AI Governance: Recent-Changes Risk & Resilience Review (2026-09-03)" discussion created in this same workflow run for the complete asset graph, control verification, and risk-scoring context.

> Generated by [UK AI Operational Resilience](https://github.com/github/gh-aw/actions/runs/33773083361) · copilot · auto · 46.9 AIC · ⌖ 18.5 AIC · ⊞ 8.1K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fuk-ai-operational-resilience%22&type=issues)

Start at pkg/workflow/mcp_setup_generator.go:146 and inspect the allocation-size computation identified by CodeQL alert #672. Trace which input can influence the size, then add a regression test for a large or edge-case input. Done means the arithmetic is safely bounded or widened, the test passes without panic or wraparound, and the CodeQL alert is resolved.

Written by the indexing model from the issue text.