fix(cursor): reject overflowing uint32 varints

[outlier27-cell]

Problem

Closes #748. Cursor protobuf decoding silently wraps overflowing five-byte uint32 varints when the final byte contains payload beyond the 32-bit range.

Value

Malformed wire values fail explicitly while every valid uint32 value, including 0xffffffff, retains its value.

Approach

Reject a fifth uint32 byte above 0x0f before the JavaScript bitwise shift. Integrate current main f98d6a47 while retaining the existing field-zero guard, entry-local map reader, int64 bound and their tests. Resolve the test-file add/add conflict by keeping the current-main map regression and appending the contributor's Counter regression.

Validation

Final integrated head: 0eb4ce30120bd677d3bf6b93cacf913d9a57a321; tested and committed tree: a507b2481b3e7c3c62921927af8becc40b05c81e. Node 26.8.1, Bun 1.3.14.

• bun install --frozen-lockfile: passed.
• node --test --experimental-strip-types tests/extensions/ai-providers/cursor-protobuf*.test.ts: 4 passed, including uint32, int64, field-zero and map-boundary regressions.
• Direct decoder smoke accepts zero and uint32 maximum, rejects overflowing/continued fifth bytes and truncated input. Independent boundary probe accepts all 8 selected uint32 boundaries and rejects all 240 malformed fifth-byte values.
• bun run check: passed, exit 0.
• bun run test: passed, exit 0; Node 2459 total / 2450 passed / 9 skipped / 0 failed; UI 88 files / 1338 passed / 0 failed.
• Source integration only; no provider/model call, installed-Pi or UI acceptance claimed.

Two independent final source reviews passed on this exact head. Current-head CI run 38696103400 passed all required checks, including Windows. Merge remains subject to the repository's independent approval requirement.

Impact

• User-visible: invalid Cursor protobuf wire data throws instead of silently wrapping.
• Model-visible context/tools: no schema changes.
• Runtime/lifecycle: shared uint32 parsing also covers tags, lengths and bools; only malformed out-of-range wire data becomes rejected.
• Persisted configuration/data: no migration or settings change.
• Compatibility/risk: two-file decoder/test change; valid uint32, current int32/int64 decoding and earlier malformed-wire protections remain intact.

[outlier27-cell]

@tt-a1i 更新：解析器相关 CI 已通过。当前唯一失败是与本 PR 无关的 Web E2E 分片（session history / prompt admission），50 个同分片测试通过；贡献者权限不允许重新运行该任务。请协助重新运行该 CI 任务，确认后本 PR 即可审核。

[outlier27-cell]

@tt-a1i 请审核此 PR。最新精确提交的 GitHub CI 已全部通过，uint32 五字节边界回归及完整校验均通过；现仅等待维护者审核。

[outlier27-cell]

@testikun @tt-a1i 请审核此 PR。最新提交的 CI 已通过，当前仅等待维护者审核与合并。

[tt-a1i]

Reviewed head: f703bae373e50e899117c207c43d52c871156917 against main a18f457687b45c877bc8a15d689a7580c4f0659a.

Standards: no confirmed code-level blocker in the scoped change.

Spec: the inspected change matches the stated behavior in this PR. The parser changes share implementation/test files; keep the independent malformed-wire regressions when integrating.

Validation: node --test --experimental-strip-types tests/extensions/ai-providers/cursor-protobuf.test.ts: exit=0; ℹ tests 1; ℹ pass 1; ℹ fail 0; ℹ skipped 0

The unchanged-head focused receipts are reused after a live head/main refresh; #718 uses this round's latest-head tests. This code review does not claim installed-runtime, live-provider, full merged-queue or visual acceptance. No merge is authorized by this review.

[tt-a1i]

Thanks! This was approved, but after the related fixes merged today (#745 / #739, #751, #753) it now conflicts with main. Could you rebase or merge main and resolve the conflict? I'll merge once CI is green on the updated head.