fix(types): validate persisted session rows

[open-inspect]

This is an automated nightly unsafe-cast remediation sweep. It replaces three selected unsafe assertions of persisted session data with package-local Zod row schemas and safeParse at the session SQLite read boundaries, following the TypeScript Coding Standards guidance for unsafe-cast / parse-don't-assert and the Zod boundary-validation pattern established in PR #807.

Finding	Risk	Cast removed	Final behavior
packages/control-plane/src/session/artifact-repository.ts	MEDIUM	result.toArray() as ArtifactRow[]	artifactRowSchema validates artifact reads. Missing single rows return null; malformed existing rows throw SessionStorageIntegrityError, preserving duplicate-PR protection and authoritative artifact discovery. Nullable url and metadata remain valid.
packages/control-plane/src/session/participant-repository.ts	MEDIUM	result.toArray() as ParticipantRow[] in identity, ID, list, and WebSocket token reads	participantRowSchema validates participant rows. Identity/ID/list reads throw SessionStorageIntegrityError for malformed rows instead of treating corruption as permission to create a duplicate participant. The token-auth lookup intentionally returns null for missing or invalid rows to fail closed. Nullable identity/token columns remain valid.
packages/control-plane/src/session/alarm/scheduler.ts	MEDIUM	.toArray() as AlarmStateRow[]	A package-local schema validates the alarm singleton, including cancelled constrained to `0

The follow-up integrity-error change addresses all three original review findings. The branch has also been updated with current main, preserving its alarm scheduling and Node SQLite adapter changes.

Original implementation verification:

Command	Result
npm run build -w @open-inspect/shared	Passed
npm run build -w @open-inspect/control-plane	Passed
npm run typecheck	Passed
npm run lint	Passed
npm run format	Passed
npm test -w @open-inspect/control-plane	Passed, 230 files / 3454 tests
git diff --check	Passed

Current-head verification is recorded in this PR's checks. Regression coverage includes malformed artifact/participant rows, nullable persisted fields, malformed alarm state, and invalid cancellation values.

References: TypeScript Coding Standards unsafe-cast / parse-don't-assert guidance, and the Zod boundary-validation pattern established in PR #807.

---

Created with Open-Inspect

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅
Tests	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @open-inspect[bot], Action: pull_request

[open-inspect]

The schemas remove unsafe assertions, but the new fallback policy is not behavior-preserving: malformed persisted state is repeatedly converted into ordinary absence. In these paths, absence controls alarm delivery, participant creation, and duplicate-PR protection, so corruption now triggers unsafe control flow rather than a visible integrity failure. Please make invalid-row handling explicit per boundary: preserve fail-closed authentication, distinguish invalid identity rows from missing rows, and do not silently erase authoritative alarm or artifact state.

I found no file-size regression; no changed file approaches 1,000 lines. The blockers are the storage-boundary semantics, not the use of Zod itself.

The authenticated GitHub App is also the PR author, so this is submitted as COMMENT; the findings should nevertheless be treated as request-changes blockers.

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅
Tests	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @open-inspect[bot], Action: pull_request

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅
Tests	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @ColeMurray, Action: pull_request

[ColeMurray]

Reviewed exact head 376f684, all changed files, migrated SQLite contracts, consumers, and all discussion. All three original review concerns are genuinely addressed: corrupt alarm and artifact rows raise integrity errors; participant identity reads do likewise while token authentication fails closed. Nullable valid data remains supported. Main synchronization preserves current scheduler behavior. No remaining blockers; exact-head CI is green, with intentional Terraform deployment skips. Shared build and changed-file lint/format checks also passed.