test(replay): type decoded fixture records without unsafe any

Give JSON.parse results in the unexpected-header regression their actual record type before searching by event tag. Preserve the forbidden-field oracle while satisfying the full type-aware lint rules; do not weaken lint or production parsing.

Validation: exact-head Linux artifact CI reported unsafe-return and unsafe-member-access in this regression. The owning replay suite passes after the local typed result correction.

packages/test-support/llm-replay/tests/llm-replay.spec.ts

@@ -702,7 +702,7 @@ describe('prepareSessionSnapshotFixtureForComparison', () => {
     }
     lines.splice(3, 0, JSON.stringify(request))
     const prepared = prepareSessionSnapshotFixtureForComparison(`${lines.join('\n')}\n`)
-    const restored = prepared.trimEnd().split('\n').map(line => JSON.parse(line))
+    const restored = prepared.trimEnd().split('\n').map(line => JSON.parse(line) as Record<string, unknown>)
     expect(restored.find(record => record.type === 'request/header')).toMatchObject(request)
     delete (request.data.header as Record<string, unknown>).system
     lines[3] = JSON.stringify(request)