refactor(cli): remove remaining zod usage, migrate to valibot

[jared-outpost]

finishes the zod→valibot migration from #1370/#1388 and drops the zod dependency entirely. covers all three coupling categories in #1371 plus the ~13 self-contained schema files that were still on zod.

what changed

• @sentry/api/zod → @sentry/api/valibot (types/sentry.ts, types/feedback.ts): switched to the v*-prefixed SDK schemas and reworked the .pick/.partial/.shape/.element derivations. valibot has no .extend, so extensions are composed via object({ ...Base.entries, ... }).
• central response validator (lib/api/infrastructure.ts + lib/api/logs.ts): z.ZodType<T> → GenericSchema<unknown, T>, schema.safeParse(x) → safeParse(schema, x), result.data/result.error.issues → result.output/result.issues. the Sentry telemetry context key is renamed zod_validation → schema_validation (⚠️ see note below).
• zod-internals introspection (lib/formatters/output.ts): extractSchemaFields/zodTypeToString read zod's _def.typeName/.shape; rewritten against valibot's runtime shape (.entries/.wrapped/.options + getDescription()), including pipe/coercion type resolution and descriptions nested under wrapper schemas.
• migrated the remaining self-contained z.object schemas (types/conversation, dashboard, replay, seer; lib/api/proguard, code-mappings, chunk-upload, dart-symbols, debug-files, preprod-artifacts, conversations, dashboards), commands/code-mappings/upload.ts, and the affected test suites' schema API usage.
• dropped zod from packages/cli/package.json + refreshed the lockfile.

testing

• tsc --noEmit: clean
• biome check ./src ./test: clean (933 files)
• generated skill docs regenerate unchanged — confirms the introspection rewrite is output-identical to the zod version
• full test/lib, test/types, test/commands suites pass (1800+ tests)

notes for reviewers

• telemetry key rename zod_validation → schema_validation in Sentry setContext — if any dashboards/alerts key off zod_validation, they'll need updating.
• @sentry/api zod peer: @sentry/api@0.256.0 still declares an optional zod: ^3.24.0 peer. with the CLI's direct zod dep removed, transitive zod (from AI SDKs) floats to v4, so pnpm prints a benign unmet-optional-peer warning. install and --frozen-lockfile both succeed; our usage goes through the valibot entrypoint so zod isn't needed at runtime.
• caught + fixed two migration regressions during self-review via the generated-docs oracle: a dropped nullable on AIConversationDetailsSchema.title, and ReplayViewOutputSchema accidentally spreading the list-item base instead of the details schema (dropping clicks/replay_type).

Closes #1371

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0108cd2. Configure here.}

[jared-outpost]

pushed d03fdb6 — addresses both Warden and Cursor Bugbot findings on the telemetry path: valibot issues are now stripped to {path: [{key, type}], type, message} before Sentry.setContext, so no raw input/value from API responses is attached (in both infrastructure.ts and logs.ts). ci is re-running on the new commit.

holding off on enabling auto-merge myself since this is a large risk: high change touching telemetry and there's no approving review yet — happy to flip it on if you want, or you can merge once ci is green.