fix(types): validate unsafe cast boundaries

[open-inspect]

This is an automated nightly unsafe-cast remediation sweep. It addresses three currently qualifying unsafe TypeScript cast findings by parsing or guarding at the boundary, following the TypeScript Coding Standards for unsafe casts / parse-don't-assert and the Zod boundary-validation pattern established in PR #807.

Finding	Risk	Cast removed	Fix
packages/shared/src/completion/extractor.ts:332 / :358 / :363 / :411	MEDIUM	Event payload args / metadata values were treated as records after assertion	Replaced with a plain record guard before reading consumed fields; malformed event metadata now falls back to existing display defaults
packages/web/src/app/api/sessions/[id]/sandbox-access/route.ts:21	MEDIUM	Control-plane 409 JSON body was asserted as { error?: unknown }	Replaced with an inline guard that only suppresses the known sandbox-unavailable conflict and preserves malformed/other conflicts
packages/control-plane/src/session/ws-client-mapping-repository.ts:48	MEDIUM	D1 websocket mapping rows were asserted as WsClientMappingResult[]	Added a package-local Zod row schema and made WsClientMappingResult a z.infer type; nullable D1 profile fields are modeled as nullable

Verification:

Command	Result
npm run build -w @open-inspect/shared	Passed
npm run build -w @open-inspect/control-plane	Passed
NODE_ENV=production npm run build -w @open-inspect/web	Passed
npm run typecheck	Passed
npm run lint	Passed
npm run format	Passed
npm test -w @open-inspect/shared	Passed: 51 files, 782 tests
npm test -w @open-inspect/control-plane	Passed: 219 files, 3344 tests
npm test -w @open-inspect/web	Passed on isolated final run: 170 files, 1311 tests

Note: npm run build -w @open-inspect/web failed once under the shell's non-standard NODE_ENV with a Next /_global-error prerender useContext error, then passed with NODE_ENV=production. Two web ESLint-boundary tests also timed out when the full web suite ran concurrently with repo-wide checks, then the isolated final web test run passed.

References: TypeScript Coding Standards unsafe-cast / parse-don't-assert guidance, and the Zod boundary-validation pattern established in PR #807.

---

Created with Open-Inspect

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅
Tests	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @open-inspect[bot], Action: pull_request