[uk-ai-resilience] Three untracked go/allocation-size-overflow alerts in MCP-gateway config generators (Tier C)

### Summary

Three open CodeQL `go/allocation-size-overflow` alerts (CWE-190, severity: warning) in actively-changed MCP-gateway/tooling config generators have **no matching open tracking issue**, breaking the classification → control-verification loop for this run's recent-changes scope (7-day lookback since 2026-09-02).

- Alert #677 — `pkg/workflow/mcp_setup_generator.go:146`
- Alert #676 — `pkg/workflow/mcp_github_config.go:84`
- Alert #675 — `pkg/workflow/mcp_github_config.go:84`

A related alert (#672) in the same `mcp_setup_generator.go` file was previously tracked in #58261, but that alert has since closed/resolved without preventing recurrence of the same finding class at a different line (#677) and in a sibling file (#676/#675).

### Tier & risk-scoring

- **Tier: C — Restricted Pending Review**
- Exposure amplification: Low–Medium (feeds GitHub Actions workflow YAML and MCP container config generation, so an overflow-triggered panic or undersized allocation could affect all generated workflows using these code paths)
- Patchability: High
- Detectability: Medium (CodeQL catches it, but it isn't visible in the tracking-issue backlog)
- Operational fragility: Medium
- Ownership confidence: Low (CODEOWNERS coverage for these files could not be verified this run)

### Remediation action

- Guard the size computation with a bounds check before use in the allocation, or widen the intermediate type (e.g., accumulate as `uint64`/`int64` before converting to a slice length), in both `mcp_setup_generator.go:146` and `mcp_github_config.go:84`.
- Add a regression test exercising a large/edge-case input to confirm no panic or wraparound occurs.
- After fixing, verify the alerts actually transition to `fixed`/`dismissed` in code scanning before closing this issue (see the companion alert-dismissal hygiene issue for why this verification step matters).

### SLA urgency

**High** — untracked alerts in actively-changed, workflow-generation-critical code reduce confidence in the classification step of the operational governance loop.

### Discussion report

See the "UK AI Governance: recent-change risk review (2026-09-02 to 2026-09-09)" discussion created by this run for full asset graph, control verification, and risk-scoring context.

> Generated by [UK AI Operational Resilience](https://github.com/github/gh-aw/actions/runs/34370632630) · copilot · auto · 80.5 AIC · ⌖ 6.82 AIC · ⊞ 8.1K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fuk-ai-operational-resilience%22&type=issues)

Start at pkg/workflow/mcp_setup_generator.go:146 and pkg/workflow/mcp_github_config.go:84, using CodeQL alerts #677, #676, and #675 to understand the allocation-size calculations. Add a regression test for large or edge-case input and verify there is no panic or wraparound. Done means the bounds or type handling is corrected and the alerts transition to fixed or dismissed in code scanning.

Written by the indexing model from the issue text.