fix(expr): resolve 2 CodeQL alerts in the ADR-0058 changes

- expression-conformance.test.ts (HIGH js/file-system-race): the ratchet's spec
  walk did statSync(p) then readFileSync(p) — a check-then-use TOCTOU window.
  Read the entry type from the single readdir syscall via withFileTypes instead.
- cel-to-filter.ts coerceLiteral (warning, comparison between inconvertible
  types): `v !== null` is dead after the preceding line returns for null — drop
  it; the early return already guarantees non-null.

No behavior change; cel-to-filter 52 + expression-conformance 7 still green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

packages/dogfood/test/expression-conformance.test.ts

@@ -8,7 +8,7 @@
 // #1887 class of declared-but-unwired predicate — breaks the build.
 
 import { describe, it, expect } from 'vitest';
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join, relative } from 'node:path';
 import { EXPRESSION_SURFACE, type ExprSurface } from './expression-conformance.ledger.js';
@@ -26,10 +26,12 @@ const DIALECTS = new Set(['cel', 'cron', 'template', 'js']);
 function discoverSurfaces(): Set<string> {
   const found = new Set<string>();
   const walk = (dir: string) => {
-    for (const e of readdirSync(dir)) {
-      const p = join(dir, e);
-      if (statSync(p).isDirectory()) walk(p);
-      else if (e.endsWith('.zod.ts')) {
+    // `withFileTypes` reads the entry type from the single readdir syscall — no
+    // stat-then-read window (avoids a file-system TOCTOU race; CodeQL).
+    for (const ent of readdirSync(dir, { withFileTypes: true })) {
+      const p = join(dir, ent.name);
+      if (ent.isDirectory()) walk(p);
+      else if (ent.isFile() && ent.name.endsWith('.zod.ts')) {
         const rel = relative(SPEC_SRC, p);
         for (const line of readFileSync(p, 'utf8').split('\n')) {
           const m = line.match(/^\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*:\s*ExpressionInputSchema\b/);

packages/formula/src/cel-to-filter.ts

@@ -387,7 +387,9 @@ function resolveValue(leaf: Leaf, ctx: Ctx): unknown {
 function coerceLiteral(v: unknown): unknown {
   if (typeof v === 'bigint') return Number(v);
   if (v === null || typeof v === 'string' || typeof v === 'number' || typeof v === 'boolean') return v;
-  if (typeof v === 'object' && v !== null && typeof (v as { valueOf?: unknown }).valueOf === 'function') {
+  // `v` is already non-null here (the line above returns for null), so a
+  // further `v !== null` would be a dead comparison; rely on the early return.
+  if (typeof v === 'object' && typeof (v as { valueOf?: unknown }).valueOf === 'function') {
     const prim = (v as { valueOf: () => unknown }).valueOf();
     if (typeof prim === 'bigint') return Number(prim);
     if (typeof prim === 'number' || typeof prim === 'string' || typeof prim === 'boolean') return prim;