Encode dynamic enclave identity TTL in nanoseconds

[lpcox]

Summary

Fix the mcpg delegation envelope generated for dynamic repository enclaves so max_identity_ttl uses Go time.Duration JSON units.

Merged PR #59046 currently emits the AWF enclave timeout integer directly:

"max_identity_ttl": enclave.Timeout,

enclave.Timeout is measured in seconds, but mcpg v0.4.17 decodes max_identity_ttl into time.Duration, whose JSON representation is an integer number of nanoseconds. A configured 120-second enclave therefore installs a 120-nanosecond identity ceiling, causing every realistic AWF create-or-confirm request to fail closed.

This blocks live dynamic enclave execution in github/gh-aw-firewall#8195 and PR github/gh-aw-firewall#8276.

Scope

• Encode max_identity_ttl as time.Duration(enclave.Timeout) * time.Second, serialized to its integer nanosecond representation.
• Keep the runtime envelope expiry clamp in seconds/RFC3339 unchanged.
• Update generated config/workflow fixtures and tests to assert the exact nanosecond wire value.
• Add a cross-contract test showing a typical timeout such as 120 seconds is accepted by the mcpg v0.4.17 envelope and allows an AWF requested TTL at or below 120 seconds.
• Preserve fail-closed validation for zero, negative, overflowing, or above-policy durations.
• Recompile generated workflows if the serialized envelope appears in lock files.

Acceptance criteria

• timeout: 120 emits "max_identity_ttl": 120000000000.
• mcpg v0.4.17 accepts the generated envelope.
• A request for a TTL of 120 seconds or less is not rejected because of a units mismatch.
• Tests prevent seconds/nanoseconds regression.

Dependencies and consumers

• Introduced by the controller bootstrap in Wire dynamic enclave delegation controller into the workflow runtime #59045 / PR Wire dynamic enclave delegation controller into the workflow runtime #59046.
• Consumed by github/gh-aw-firewall#8195 / PR github/gh-aw-firewall#8276.
• mcpg contract: github/gh-aw-mcpg#12604, released in v0.4.17.