fix(types): validate unsafe boundary casts

[open-inspect]

This is an automated nightly unsafe-cast remediation sweep. It addresses up to three currently qualifying unsafe TypeScript casts by parsing or guarding at the boundary, following the TypeScript Coding Standards for unsafe casts / parse-don't-assert and the Zod boundary-validation pattern established in PR #807.

Finding	Risk	Cast removed	Fix
packages/control-plane/src/session/message-queue.ts:681	HIGH	JSON.parse(originContext) as GitHubAutofixOrigin bypassed the existing shared schema for persisted Autofix origin context	Reused githubAutofixOriginSchema.safeParse; invalid persisted origin keeps the existing log-and-omit behavior
packages/control-plane/src/db/pr-autofix-feedback-store.ts:101	MEDIUM	JSON.parse(atob(cursor)) as Partial<ActivityCursor> asserted an opaque cursor before validation	Replaced with an inline record guard and existing field checks; invalid cursors still throw Invalid Autofix activity cursor
packages/control-plane/src/db/automation-store.ts:1145 / :1148	MEDIUM	D1 invocation rows and derived status were asserted with (pageResult.results ?? []) as ... and row.derived_status as AutomationInvocationStatus	Added a package-local Zod row schema using the shared automationInvocationStatusSchema; nullable D1 fields are modeled as .nullable() and malformed rows are not exposed as API state

Verification:

Command	Result
npm run build -w @open-inspect/shared	Passed
npm run build -w @open-inspect/control-plane	Passed
npm run typecheck	Passed
npm run lint	Passed
npm run format	Passed
npm test -w @open-inspect/control-plane	Passed: 220 files, 3327 tests

---

Created with Open-Inspect

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅
Tests	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @open-inspect[bot], Action: pull_request