fix(types): validate persisted session rows

[open-inspect]

This is an automated nightly unsafe-cast remediation sweep. It replaces three selected unsafe assertions of opaque persisted session data with package-local Zod row schemas and safeParse at the D1 read boundaries, following the TypeScript Coding Standards guidance for unsafe-cast / parse-don't-assert and the Zod boundary-validation pattern established in PR #807.

Finding	Risk	Cast removed	Fix
packages/control-plane/src/session/artifact-repository.ts:51	MEDIUM	result.toArray() as ArtifactRow[] for persisted artifact rows	Added artifactRowSchema in session/types.ts; listArtifacts filters malformed rows and getArtifactById returns null for malformed rows while preserving nullable url/metadata.
packages/control-plane/src/session/participant-repository.ts:39, :44, :49, :129	MEDIUM	result.toArray() as ParticipantRow[] for persisted participant rows, including WebSocket token lookup	Added participantRowSchema in session/types.ts; single-row lookups parse before returning and list reads filter malformed rows while preserving nullable identity/token columns.
packages/control-plane/src/session/alarm/scheduler.ts:89	MEDIUM	.toArray() as AlarmStateRow[] for the persisted alarm singleton row	Added a package-local alarmStateRowSchema; malformed alarm state is treated as absent while nullable pending/in-flight deadlines remain valid.

Verification:

Command	Result
npm run build -w @open-inspect/shared	Passed
npm run build -w @open-inspect/control-plane	Passed
npm run typecheck	Passed
npm run lint	Passed
npm run format	Passed
npm test -w @open-inspect/control-plane	Passed, 230 files / 3454 tests
git diff --check	Passed

References: TypeScript Coding Standards unsafe-cast / parse-don't-assert guidance, and the Zod boundary-validation pattern established in PR #807.

---

Created with Open-Inspect

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅
Tests	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @open-inspect[bot], Action: pull_request

[open-inspect]

The schemas remove unsafe assertions, but the new fallback policy is not behavior-preserving: malformed persisted state is repeatedly converted into ordinary absence. In these paths, absence controls alarm delivery, participant creation, and duplicate-PR protection, so corruption now triggers unsafe control flow rather than a visible integrity failure. Please make invalid-row handling explicit per boundary: preserve fail-closed authentication, distinguish invalid identity rows from missing rows, and do not silently erase authoritative alarm or artifact state.

I found no file-size regression; no changed file approaches 1,000 lines. The blockers are the storage-boundary semantics, not the use of Zod itself.

The authenticated GitHub App is also the PR author, so this is submitted as COMMENT; the findings should nevertheless be treated as request-changes blockers.

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅
Tests	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @open-inspect[bot], Action: pull_request