fix: replace 124 unsafe millisecond casts missed by PR #1182

[rahulkr182]

📋 Summary

Fixes all 124 unsafe millisecond as u64 casts that PR #1182 missed. Six of them are real correctness bugs that silently corrupt timestamps or analytics counters when the system clock is misconfigured. The remaining 118 are coding-standard violations (u128 → u64 without overflow handling).

🔗 Related Issues

Closes #1290

Related to #394, #1172, #1182

---

🧠 Context

PR #1182 replaced as u64 casts with u64::try_from() in 4 files (mofa-kernel and mofa-runtime), but the same unsafe pattern survived in 38 more files across 8 crates. A workspace-wide grep turned up 124 remaining sites split into three risk categories:

• Flavour A (5 lines): chrono::Utc::now().timestamp_millis() as u64 — timestamp_millis() returns i64, so any pre-epoch clock wraps to near u64::MAX, corrupting audit trails and HITL telemetry.
• Flavour C (1 line): signed_duration_since().num_milliseconds() as u64 — negative durations from NTP clock skew wrap total_wait_time_ms to ~u64::MAX.
• Flavour B (118 lines): Duration::as_millis() as u64 — u128 → u64 without overflow handling, prohibited by coding standard §VII.2.

---

🛠️ Changes

• Added chrono_now_ms() to mofa-kernel/src/utils.rs — a safe counterpart to the existing now_ms(), using try_into().unwrap_or(0) to prevent signed→unsigned wraparound on chrono timestamps. Includes 3 new unit tests.
• Replaced 5 Flavour A sites (in hitl/audit.rs, workflow/executor.rs, agent/components/tool.rs, workflow_viz/main.rs) with chrono_now_ms() or inline safe casts.
• Fixed the Flavour C site in workflow/executor.rs with .max(0) clamp before try_into() to prevent NTP-skew-induced wraparound.
• Replaced 118 Flavour B sites across mofa-foundation, mofa-extra, mofa-plugins, mofa-gateway, mofa-cli, mofa-runtime, tests/, and examples/ with either u64::try_from(...).unwrap_or(u64::MAX) or mofa_kernel::utils::now_ms() for multi-line SystemTime chains.
• Fixed tests/src/clock.rs MockClock to use proper u64::try_from() wrapping inside AtomicU64 operations.
• Ran cargo fmt on all touched files.

---

🧪 How you Tested

1. cargo check --workspace — zero errors, only pre-existing ambiguous_glob_reexports warning
2. cargo test --workspace — all ~1200 tests pass, 0 failures
3. cargo test -p mofa-kernel -- utils — specifically validates the 3 new chrono_now_ms() tests
4. Verified zero remaining unsafe casts:

   grep -rn "timestamp_millis() as u64\|\.as_millis() as u64\|num_milliseconds() as u64" \
     --include="*.rs" crates/ tests/ examples/ | grep -v target/
   # Returns 0 results

---

📸 Screenshots / Logs (if applicable)

cargo test --workspace
...
test result: ok. 124 passed; 0 failed; ...  (mofa-kernel)
test result: ok. 742 passed; 0 failed; ...  (mofa-foundation)
test result: ok. 86 passed; 0 failed; ...   (mofa-runtime)
... all crates pass ...

---

⚠️ Breaking Changes

• No breaking changes

---

🧹 Checklist

Code Quality

• Code follows Rust idioms and project conventions
• cargo fmt run
• cargo clippy passes without warnings

Testing

• Tests added/updated
• cargo test passes locally without any error

Documentation

• Public APIs documented
• README / docs updated (if needed)

PR Hygiene

• PR is small and focused (one logical change)
• Branch is up to date with main
• No unrelated commits
• Commit messages explain why, not only what

---

🚀 Deployment Notes (if applicable)

None — all changes are internal type-conversion improvements. No API, config, or schema changes.

---

🧩 Additional Notes for Reviewers

• The chrono_now_ms() function in mofa-kernel/src/utils.rs mirrors the existing now_ms() (which uses SystemTime) but for chrono::Utc::now().
• Multi-line SystemTime::now().duration_since(UNIX_EPOCH).unwrap_or_default().as_millis() as u64 chains were replaced wholesale with mofa_kernel::utils::now_ms() since that function does exactly the same thing, safely.
• Inside mofa-kernel itself, references use crate::utils::now_ms() (not mofa_kernel::).
• The tests/src/clock.rs MockClock needed manual restructuring because the AtomicU64 method calls (new(), fetch_add(), store()) had the as u64 cast as an argument, not a chain suffix.