fix(types): validate cached JSON and webhook filters

[open-inspect]

This is an automated nightly unsafe-cast remediation sweep, updated after review to preserve existing webhook configuration and editor behavior.

Changes

• Make JSON reads through CacheStore, its Cloudflare KV adapter, and SqlCacheStore return unknown instead of a caller-selected generic type.
• Validate cached GitHub installation tokens and repository lists with local Zod schemas; malformed entries become cache misses and are refreshed normally.
• Replace webhook comparison assertions with explicit Number/String coercion while preserving the existing scalar filter schema and JavaScript comparison semantics. Existing numeric-string comparisons and numeric contains values remain accepted, including configurations emitted by the current editor.
• Keep the webhook editor unchanged. The initial schema tightening would have rejected existing saved configurations and forced incomplete numeric edits to zero.
• Strengthen cache regression fixtures to exercise validation itself: the malformed repository cache has a matching SCM identity and fresh TTL, and the malformed token has valid timestamps but an invalid token type.

Verification

• Shared TypeScript build passed.
• Shared trigger-schema and webhook-normalizer tests: 34 passed, including persisted scalar compatibility and invalid non-scalar configuration cases.
• Control-plane authentication, repository route, SQL cache, and Node cache conformance tests: 45 passed.
• Real workerd Cloudflare KV/D1 cache conformance: 15 passed, 1 intentionally skipped because the KV clock cannot be advanced.
• ESLint and Prettier checks passed for all changed files.
• Full workspace npm run typecheck passed, including control-plane unit/integration/Node configurations, all bots, infrastructure packages, shared, and web.
• All applicable GitHub checks passed at 076a30cfb8970f4ec4f79a5e1f9c53c8d1a58d24, including both integration shards and Compose smoke; Terraform Plan/Apply are intentionally skipped for PR validation.
• Merged current upstream main without conflicts; no dependency changes are introduced by this PR.

---

Created with Open-Inspect

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅
Tests	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @open-inspect[bot], Action: pull_request

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅
Tests	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @ColeMurray, Action: pull_request

[ColeMurray]

Reviewed exact head 076a30c, all changed files, cache adapters/consumers, webhook configuration compatibility and all discussion. Follow-up retains existing persisted filter/editor behavior, replaces assertions with compatible explicit scalar coercions, and repairs regression fixtures so they genuinely exercise cache validation. The unknown-return cache boundary remains useful on main. Shared/cache/workerd tests passed (34 + 45 + 15, one intentional clock skip), as did full workspace typecheck and lint/format. All applicable exact-head CI is green; Terraform deployment jobs intentionally skipped. No actionable comments or remaining blockers.