feat(client): validate safe integer range for x-mcp-header parameters (#445)

[Yudis-bit]

Closes #445.

What

Per the Streamable HTTP specification (SEP-2243) and server/tools.mdx:

Constraints on x-mcp-header values:
Integer values MUST be within the safe range for integers represented using IEEE754 double-precision floating point numbers (−2^53+1 to 2^53−1).

Previously, this requirement was completely uncovered in the conformance test harness:

• No check definition in src/seps/sep-2243.yaml (the list stopped at primitive-only).
• No check ID emitted in src/scenarios/client/http-custom-headers.ts.
• No scenario asked the client under test to call an annotated integer tool with an out-of-range integer value (e.g. 2**53 = 9007199254740992).
• An SDK that mirrored out-of-range integers into Mcp-Param-* headers passed the conformance suite with zero indication.

Changes

1. src/seps/sep-2243.yaml:
   • Added normative check requirement:

     - check: sep-2243-x-mcp-header-integer-safe-range
       text: 'Integer values MUST be within the safe range for integers represented using IEEE754 double-precision floating point numbers (−2^53+1 to 2^53−1).'
       url: https://modelcontextprotocol.io/specification/draft/server/tools#custom-headers

2. src/scenarios/client/http-custom-headers.ts:
   • Added 'sep-2243-x-mcp-header-integer-safe-range' to CUSTOM_HEADERS_DECLARED_CHECK_IDS.
   • Added an annotated integer property unsafe_integer_val with x-mcp-header: 'UnsafeInteger' to the test_custom_headers tool definition.
   • Supplied unsafe_integer_val: 9007199254740992 (2**53) in urls.context.toolCalls[0].arguments.
   • In handleToolsCall, verified that the client does not mirror out-of-range integer arguments into Mcp-Param-UnsafeInteger, emitting SUCCESS when omitted and FAILURE when mirrored.
3. src/scenarios/client/http-custom-headers.test.ts:
   • Added unit test verifying FAILs safe-integer-range when a client mirrors an out-of-range integer header.
   • Added unit test verifying PASSes safe-integer-range when a client omits the out-of-range integer header.
   • Updated existing tool-call assertions to supply unsafe_integer_val and verify that all declared requirement IDs in CUSTOM_HEADERS_DECLARED_CHECK_IDS pass on conforming tool calls.
4. src/seps/traceability.json:
   • Updated SEP-2243 traceability entries and summary (tested: 19).

Validation

• npm run check: typecheck (tsgo --noEmit) and lint (eslint & prettier) pass cleanly with 0 errors, 0 warnings.
• npm run build: builds dist/index.js cleanly with 0 errors.
• npm test: all 45 test files, 589 tests pass across the suite.
• Pre-push hooks: formatting, linting, and full test suite pass cleanly on push.

AI assistance disclosure: Generated with Antigravity agent in pair-programming session following maintainer instructions on issue #445 with minimal reproducible test coverage.