fix(types): validate script JSON boundaries

[open-inspect]

This is an automated nightly unsafe-cast remediation sweep. It replaces selected unsafe TypeScript casts at external/opaque JSON boundaries with local parse-and-validate guards, following the TypeScript Coding Standards guidance for unsafe casts / parse-don't-assert and the Zod boundary-validation pattern established in PR #807. These two script-local boundaries do not justify a new dependency, so the fixes use narrow inline structural guards instead of adding a schema library at the root.

Finding	Risk	Cast removed	Fix
scripts/cf-logs.ts:394	Low	Cloudflare telemetry await response.json() asserted as a response object	Added parseTelemetryQueryResponse to parse as unknown, require the consumed success boolean, and safely extract optional errors/events fields.
scripts/merge-split-users.ts:144	Medium	Wrangler D1 JSON.parse(child.stdout) asserted as WranglerQueryResult[]	Added parseWranglerQueryResults to parse as unknown, require array entries with a boolean success, and safely extract results/meta.changes.

Verification:

Command	Result
npm run build -w @open-inspect/shared	Passed
npm run typecheck	Passed
npm run lint	Passed
npm run format	Passed
git diff --check	Passed

Unit tests: not applicable for this sweep because only root scripts were touched and no workspace package test seam exists for these side-effecting CLI scripts.

---

Created with Open-Inspect

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅
Tests	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @open-inspect[bot], Action: pull_request