test: add comprehensive E2E + adversarial tests for check command

- 58 new tests covering full handler flow with mocked `Dispatcher.call()`
- E2E: all 7 check types, `--fail-on` exit codes, `--severity` filtering,
  `--policy` validation, unknown check names, schema resolution, batching,
  text/JSON output, mixed success/failure across checks
- Adversarial: null bytes, shell metacharacters, 100K-char lines, Unicode/emoji,
  CRLF, spaces in filenames, deeply nested paths, malformed policy JSON, 1MB
  policy files, undefined/null finding fields, 5000 findings, XSS-like content,
  non-string severity, `__proto__` pollution, binary `.sql` content, symlinks,
  directory with `.sql` extension, duplicate file args, empty checks string
- Fix: `normalizeSeverity()` now handles non-string inputs without crashing
  (previously threw on numeric/boolean/object severity from Dispatcher)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: anandgupta42

packages/opencode/src/cli/cmd/check-helpers.ts

@@ -49,8 +49,8 @@ export const VALID_CHECKS = new Set(["lint", "validate", "safety", "policy", "pi
 // Helpers
 // ---------------------------------------------------------------------------
 
-export function normalizeSeverity(s?: string): Severity {
-  if (!s) return "warning"
+export function normalizeSeverity(s?: string | unknown): Severity {
+  if (!s || typeof s !== "string") return "warning"
   const lower = s.toLowerCase()
   if (lower === "error" || lower === "fatal" || lower === "critical") return "error"
   if (lower === "warning" || lower === "warn") return "warning"