fix: prevent ReDoS in extractMeta regex by anchoring to splice boundary

Co-Authored-By: deepseek-v4-pro <deepseek-ai@claude-code-best.win>

packages/workflow-engine/src/engine/script.ts

@@ -86,10 +86,9 @@ export function extractMeta(source: string): {
   const meta = validateMeta(metaObj)
 
   // Strip the meta statement (including trailing semicolon and extra blank lines)
-  const body = (source.slice(0, match.index) + source.slice(i)).replace(
-    /[ \t]*;[ \t]*\n/,
-    '\n',
-  )
+  const body =
+    source.slice(0, match.index) +
+    source.slice(i).replace(/^[ \t]*;[ \t]*\n/, '\n')
   return { meta, body }
 }