#413-418)

This commit addresses 6 HIGH severity integer overflow vulnerabilities
detected by gosec (G115) where uint and uint64 values were being
converted to int without checking for potential overflow.

Files modified:
- pkg/workflow/frontmatter_extraction_metadata.go
- pkg/workflow/safe_inputs_parser.go

Security fixes:
- Alert #415: uint64 to int overflow in extractToolsStartupTimeout
- Alert #416: uint64 to int overflow in extractToolsTimeout
- Alert #417: uint to int overflow in extractToolsStartupTimeout
- Alert #418: uint to int overflow in extractToolsTimeout
- Alert #413: uint64 to int overflow in safe_inputs_parser (line 398)
- Alert #414: uint64 to int overflow in safe_inputs_parser (line 214)

Implementation:
- Added safeUintToInt() and safeUint64ToInt() helper functions in
  frontmatter_extraction_metadata.go
- Added safeUint64ToIntForTimeout() helper function in safe_inputs_parser.go
- These functions check if the value exceeds math.MaxInt before conversion
- Returns 0 (engine default timeout) if overflow would occur
- Applied safe conversions to all problematic uint/uint64 to int casts

Testing:
- All existing tests pass
- No breaking changes to functionality
- Overflow cases now safely default to 0 instead of causing undefined behavior

Impact:
- Risk: Minimal
- Breaking changes: None
- Backwards compatibility: Full
- On systems where a timeout value would overflow, defaults to 0 (engine default)

🤖 Generated with Claude Code

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>