fix(core): replace unsound AggregateError cast with runtime narrowing in flatErrors

The previous cast to (RulesetValidationError | AggregateError)[] was
unsound — AggregateError.errors is untyped by spec and can hold arbitrary
values. Rewrite flatErrors to accept unknown, narrow with instanceof/
isAggregateError at runtime, and always return RulesetValidationError[].
This eliminates the cast, drops the Array.isArray branch in the caller,
and silently discards unexpected entries rather than propagating them
typed as RulesetValidationError.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: kopernic-pl

packages/core/src/ruleset/validation/errors.ts

@@ -94,9 +94,7 @@ export function convertAjvErrors(
 
   return filteredErrors.flatMap(error => {
     if (error.keyword === 'x-spectral-runtime') {
-      const flat = flatErrors(error.params.errors);
-      const list = Array.isArray(flat) ? flat : [flat];
-      return list.map(e => enrichWithLocation(e, sourceContext));
+      return flatErrors(error.params.errors).map(e => enrichWithLocation(e, sourceContext));
     }
 
     const path = error.instancePath.slice(1).split('/');
@@ -109,12 +107,16 @@ export function convertAjvErrors(
   });
 }
 
-function flatErrors(error: RulesetValidationError | AggregateError): RulesetValidationError | RulesetValidationError[] {
+function flatErrors(error: unknown): RulesetValidationError[] {
   if (isAggregateError(error)) {
-    return (error.errors as (RulesetValidationError | AggregateError)[]).flatMap(flatErrors);
+    return error.errors.flatMap(flatErrors);
   }
 
-  return error;
+  if (error instanceof RulesetValidationError) {
+    return [error];
+  }
+
+  return [];
 }
 
 function resolveLocation(