[uk-ai-resilience] Untracked go/allocation-size-overflow alert #678 in mcp_cli_mount.go — sibling of #59773 (Tier C)

### Summary

CodeQL alert `#678` (`go/allocation-size-overflow`, CWE-190, severity: **high**) in the MCP gateway config generator has **no matching open tracking issue**, breaking the classification → control-verification loop for this run's recent-changes scope (7-day lookback since 2026-09-07).

- **Alert**: [#678](https://github.com/github/gh-aw/security/code-scanning/678) — `pkg/workflow/mcp_cli_mount.go:378`
- Created 2026-09-11; still open at time of this review.

This is the **same finding class** as sibling alerts #677/#676/#675 (`mcp_setup_generator.go:146`, `mcp_github_config.go:84` x2), which are already tracked in open issue #59773 (Tier C) — but that issue does **not** cover `mcp_cli_mount.go:378`. This is now the 4th untracked instance of `go/allocation-size-overflow` in the MCP config-generation area.

### Tier & risk-scoring

- **Tier: C — Restricted Pending Review**
- Exposure amplification: Low–Medium (feeds MCP container mount/config generation for agentic workflows; an overflow-triggered panic or undersized allocation could affect all generated MCP configs using this code path)
- Patchability: High
- Detectability: Medium (CodeQL catches it, but it isn't visible in the tracking-issue backlog, and the reconciliation gap with #59773 shows sibling-alert tracking is incomplete)
- Operational fragility: Medium
- Ownership confidence: Low-Medium (repository CODEOWNERS is a single flat global rule with no path-specific reviewer for `pkg/workflow/`)

### Remediation action

- Guard the size computation with a bounds check before use in the allocation at `mcp_cli_mount.go:378`, or widen the intermediate type (e.g., accumulate as `uint64`/`int64` before converting to a slice length) — consistent with the fix pattern requested in #59773 for the sibling files.
- Add a regression test exercising a large/edge-case input to confirm no panic or wraparound occurs.
- Consider addressing all four `go/allocation-size-overflow` instances (#675/#676/#677/#678) together in one PR/fix pass, and update #59773 to reference this issue to avoid future reconciliation drift.
- After fixing, verify the alert transitions to `fixed`/`dismissed` in code scanning before closing this issue.

### SLA urgency

**Critical** — untracked, security-severity-"high" alert in actively-changed MCP config-generation code that is part of a recurring, partially-tracked finding class.

### Related

- Sibling tracking issue (does not cover this alert): #59773

### Discussion report

See the "UK AI Governance: recent-change risk review (2026-09-07 to 2026-09-14)" discussion created by this run for full asset graph, control verification, and risk-scoring context.

> Generated by [UK AI Operational Resilience](https://github.com/github/gh-aw/actions/runs/34862662555) · copilot · auto · 82.3 AIC · ⌖ 8.97 AIC · ⊞ 8.2K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fuk-ai-operational-resilience%22&type=issues)

Start at pkg/workflow/mcp_cli_mount.go:378 and compare the requested remediation with the sibling handling tracked in issue #59773. Add a regression test for a large or edge-case input, then run the relevant Go tests. Done means the overflow behavior is covered and CodeQL alert #678 transitions to fixed or dismissed.

Written by the indexing model from the issue text.