Address CodeRabbit feedback: add Zod validation to extractWorkflow

Replace unsafe type casts with Zod schema validation for the workflow
container structure. Full workflow validation still happens downstream
via validateComfyWorkflow.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

src/platform/remote/comfyui/jobs/fetchers/fetchJobs.ts

@@ -6,6 +6,8 @@
  * All distributions use the /jobs endpoint.
  */
 
+import { z } from 'zod'
+
 import type { ComfyWorkflowJSON } from '@/platform/workflow/validation/schemas/workflowSchema'
 import type { PromptId } from '@/schemas/apiSchema'
 
@@ -143,6 +145,22 @@ export async function fetchJobDetail(
   }
 }
 
+/**
+ * Schema for workflow container structure.
+ * Full workflow validation happens downstream via validateComfyWorkflow.
+ */
+const zWorkflowContainer = z.object({
+  extra_data: z
+    .object({
+      extra_pnginfo: z
+        .object({
+          workflow: z.unknown()
+        })
+        .optional()
+    })
+    .optional()
+})
+
 /**
  * Extracts workflow from job detail response.
  * The workflow is nested at: workflow.extra_data.extra_pnginfo.workflow
@@ -150,11 +168,10 @@ export async function fetchJobDetail(
 export function extractWorkflow(
   job: JobDetail | undefined
 ): ComfyWorkflowJSON | undefined {
-  // Cast is safe - workflow will be validated by loadGraphData -> validateComfyWorkflow
-  const workflowData = job?.workflow as
-    | { extra_data?: { extra_pnginfo?: { workflow?: unknown } } }
-    | undefined
-  return workflowData?.extra_data?.extra_pnginfo?.workflow as
+  const parsed = zWorkflowContainer.safeParse(job?.workflow)
+  if (!parsed.success) return undefined
+  // Full workflow validation happens downstream via validateComfyWorkflow
+  return parsed.data.extra_data?.extra_pnginfo?.workflow as
     | ComfyWorkflowJSON
     | undefined
 }