fix: bound basic constraints path length

[leopoldjoy]

Summary

• reject BasicConstraints pathLenConstraint values above int64.max before casting
• preserve canonical DER INTEGERs within the contract range without imposing a fixed byte-length cap
• add boundary tests for int64.max and 2^63

Verification

• forge test --match-contract CertManagerTest
• forge build --sizes (compile succeeds; raw size command still fails on oversized test harnesses, addressed by prerequisite ci: scope size check to deployables #73; deployable CertManager margin is 75 bytes)