fix(pilotctl): bounds-check --net before uint16 truncation (CodeQL #21,#23,#24,#25,#32)

[TeoSlayer]

Summary

Closes 5 CodeQL "Incorrect conversion between integer types" alerts by introducing flagNetID — a helper that validates --net N is in 0..65535 before casting int → uint16, rather than silently truncating.

Before: --net 70000 → uint16(70000 & 0xFFFF) = 4464 — command runs against the wrong network with no warning.
After: --net 70000 → fatal invalid_argument: --net must be in 0..65535, got 70000.

Closes

• CodeQL Unit 4: Config-driven fleet enrollment — auto-join networks #21 (main.go:6331)
• CodeQL Unit 2: Registry hardening — rate limiting, snapshot signing, IPC audit #23 (main.go:6345)
• CodeQL Unit 3: Peer resilience — endpoint caching, pubkey TTL, partition recovery #24 (main.go:6369)
• CodeQL Unit 5: pilotctl network CLI — IPC commands for network management #25 (main.go:6392)
• CodeQL Unit 7: Fix misleading claims across README and website #32 (main.go:6409)

Not addressed in this PR

• CodeQL Unit 1: Microsoft Entra ID (Azure AD) integration #41 (workflow permissions): needs workflow OAuth scope. The required changes (add permissions: contents: read at the workflow root level of codeql.yml and notify-canary.yml) are trivial — refresh your gh token with gh auth refresh -s workflow and either commit them directly or ping me to push.
• CodeQL [ImgBot] Optimize images #1, test: add e2e testing, coverage and pre-commits #2, [ImgBot] Optimize images #3, Refactor/maintainability #4, Proposal: Lambda Lang as semantic encoding layer for agent messages #5, feat: implement task submit service #6, feat(pilotctl): add --encoding flag to send-message #8, Unit 1: OIDC join rule — accept JWT tokens from enterprise identity providers #37: stale ([ImgBot] Optimize images #1–feat: implement task submit service #6, feat(pilotctl): add --encoding flag to send-message #8 point to code that no longer exists at those line numbers after refactors / pkg/protocol extraction); Unit 1: OIDC join rule — accept JWT tokens from enterprise identity providers #37 is a theoretical overflow that requires a payload ≥ 9.2 quintillion bytes — not exploitable through the IPC framing. These should be dismissed.

Test plan

• go build ./cmd/pilotctl/... succeeds
• pilotctl network info --net 70000 now aborts instead of silently picking net 4464
• Existing --net 1 / --net 100 flows unchanged