Harden MCP WebSocket frame length conversions

[beiwei30]

What changes

Replace lossy MCP WebSocket payload-length casts with checked conversions and typed protocol failures. Incoming peer-controlled lengths retain the 8 MiB limit and are rejected before platform-width conversion or allocation.

Add boundary coverage for 0, 125, 126, 65,535, 65,536, 8 MiB, 8 MiB + 1, and encoded u64::MAX, including a host-independent 32-bit bound proof.

Verification

Passed:

• cargo test -p orbcode-mcp websocket_frame: 4 passed
• cargo test -p orbcode-mcp: 137 unit, 27 stdio fixture, and 7 trust fixture tests passed
• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo check --workspace
• cargo test --workspace
• scripts/check-docs.sh
• scripts/audit-public-surface.sh
• scripts/audit-brand.sh
• git diff --check

The focused cast_possible_truncation audit no longer reports the three approved WebSocket conversions. Existing deferred diagnostics in other owners remain unchanged.

Compatibility

• No golden fixture under compat-fixtures/fixtures/ or tui/testdata/ changed.
• No TypeScript-CLI compatibility name was renamed. scripts/audit-brand.sh passes.
• No new public API was added. scripts/audit-public-surface.sh passes.
• Behavioral change is covered by tests in orbcode-mcp.

Notes for the reviewer

P3-01 limits this maintenance slice to mcp/src/transport/websocket.rs. OAuth timing, tool buffers, protocol DTO widths, provider conversions, and TUI coordinates remain explicitly deferred.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.