fix(cli): reject non-decimal pyc and BEAM limit options (#9060)

inspect-python-pyc and inspect-erlang-beam took their max-* limits through Number(), so 0x10 meant 16 and 1e2 meant 100. Admit decimal text only through cliDecimalField, which now keeps the shared field's description for help.

src/cli/pythonPycCommands.ts

@@ -15,6 +15,7 @@ import {
 } from "./analysisEvidenceDelivery.js";
 import { pythonPycDeliverySchema } from "../domain/analysisView/pythonPycView.js";
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { cliDecimalField } from "./options.js";
 
 /** Inspect operator-selected pyc files through the same shared workflow as MCP. */
 export const registerPythonPycCommands = (
@@ -28,10 +29,18 @@ export const registerPythonPycCommands = (
       path: localPathStringSchema.describe("Local CPython .pyc file"),
     }),
     options: z.object({
-      maxFileBytes: inspectPythonPycInputSchema.shape.max_file_bytes,
-      maxObjects: inspectPythonPycInputSchema.shape.max_objects,
-      maxDepth: inspectPythonPycInputSchema.shape.max_depth,
-      maxStringBytes: inspectPythonPycInputSchema.shape.max_string_bytes,
+      // Decimal tokens only: numeric coercion would read "0x10" as 16 and
+      // "1e2" as 100. The shared fields keep their bounds and defaults.
+      maxFileBytes: cliDecimalField(
+        inspectPythonPycInputSchema.shape.max_file_bytes,
+      ),
+      maxObjects: cliDecimalField(
+        inspectPythonPycInputSchema.shape.max_objects,
+      ),
+      maxDepth: cliDecimalField(inspectPythonPycInputSchema.shape.max_depth),
+      maxStringBytes: cliDecimalField(
+        inspectPythonPycInputSchema.shape.max_string_bytes,
+      ),
       ...analysisEvidenceDeliveryOptions,
       view: z
         .string()