fix: type and validate GitHub responses against real schemas

[blimmer]

Summary

Follow-up to the PATCHWAVE-ANALYSIS-CLI-1 hot-fix (#21). The root cause was that GithubClient took the response type as a blind caller-supplied generic (paginate<T>(route: string, …)), so every collector hand-rolled a response interface that could drift from GitHub's real API. This binds our types to the published schemas and adds a runtime safety net for the cases types can't catch:

• REST — paginate/request are now generic over the route literal, deriving params + response types from octokit's Endpoints / PaginatingEndpoints. Field typos and genuinely-absent/nullable fields now fail at compile time.
• GraphQL — graphql() takes a TypedDocumentNode; the Dependabot-PR query moved to a .graphql file with types generated by graphql-codegen against @octokit/graphql-schema (no more hand-rolled RawPullRequest/RawActor).
• Runtime validation — paginate() accepts a Zod schema reflecting reality; invalid items are dropped with a warning instead of crashing the scan. Collectors keep ownership of normalization (schema + raw→domain map), so everything downstream still sees only clean domain types.

Build wiring is consolidated behind one bun run build:assets step (graphql codegen + report-web) referenced by package scripts, the justfile, and goreleaser. The generated module is committed and excluded from lint/format.

just verify passes (format, typecheck, lint, 118 unit + 20 browser tests). Codegen output is deterministic (regenerating leaves no diff).

Review focus

• Why runtime validation is the real fix, not the types. I initially claimed octokit's types would compile-catch the original author.login crash — they don't. octokit models the empty-author arm as Record<string, never>, whose index signature makes author.login type-check as string even with noUncheckedIndexedAccess on. So the typed seam catches drift/typos/nullable-unions, but the Zod validation in contributors.ts (and the others) is what actually prevents the empty-object class. Worth sanity-checking that reasoning.
• The route-typed seam casts to octokit's loose overloads (route as string) at the transport boundary in GithubClientImpl — the public interface is the source of truth; the cast is contained there.
• Schema strictness vs. dropping data. repoSchema requires only name+owner; everything else is optional/defaulted so a repo is never dropped for a field GitHub omits. cve's security_vulnerability is nullable (null alerts skipped). Confirm these match the behavior you want.

Commits

Single commit — the seam change doesn't compile until every collector migrates, so it's one logical unit.

• 4d480a5 — type and validate GitHub responses against real schemas

Manual verification not yet done

• A live bun run start <org> smoke run against a real org (needs a token + network; not run in this environment).

[blimmer]

Using legit graphql-codegen now against their gql schemas

[blimmer]

Sometimes they don't even follow their own schema, like here.