fix(types): replace unsafe casts with validated parsing

[open-inspect]

Automated nightly unsafe-cast remediation sweep. This PR fixes three qualifying unsafe TypeScript casts by parsing at the boundary instead of asserting, following the TypeScript Coding Standards guidance for unsafe casts / parse-don't-assert and the Zod boundary-validation pattern established in PR #807.

Finding	Risk	Cast removed	Fix
packages/control-plane/src/routes/slack-notify.ts:221	HIGH	raw as Record<string, unknown> on request.json() body	Added slackNotifyBodySchema with z.infer and safeParse, preserving the existing invalid_input response contract and null-as-absent optional fields.
packages/shared/src/triggers/webhook/normalizer.ts:24 and :51	HIGH	body/current as Record<string, unknown> on generic webhook payloads	Added webhookObjectSchema and safeParse before idempotency stripping and JSONPath traversal.
packages/control-plane/src/session/pull-request-snapshot.ts:87	MEDIUM	parsed as Record<string, unknown> on persisted artifact metadata JSON	Added artifactMetadataSchema and safeParse, preserving malformed/non-object fallback to {}.

Verification commands run:

Command	Result
npm run build -w @open-inspect/shared	Passed
npm run build -w @open-inspect/control-plane	Passed
npm run typecheck	Passed
npm run lint	Passed
npm run format	Passed
npm test -w @open-inspect/shared	Passed, 58 files / 943 tests
npm test -w @open-inspect/control-plane	Passed, 311 files / 4980 tests
git diff --check and git diff --cached --check	Passed

---

Created with Open-Inspect

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a9263f8d-87e0-4848-bd17-e4ab32c6bfc6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅
Tests	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @open-inspect[bot], Action: pull_request