test(service-automation): narrow the defence-in-depth EvalResult pin on its discriminant before reading error

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M59rPZZFzqhfMUPFqqZTkf

Author: claude

packages/services/service-automation/src/builtin/assignment-value-envelope.test.ts

@@ -278,9 +278,11 @@ describe('assignment value envelope — one notion of malformed (#15137)', () =>
     // Not a path authored metadata can take (both validators and the executor
     // run the schema first); kept so the last layer never silently answers a
     // value if a future caller bypasses the door.
-    const result = ExpressionEngine.evaluate({ dialect: 'cel', ast: { op: 'value' } }, {} as never);
-    expect(result.ok).toBe(false);
-    expect(result.error?.message).toContain('AST-only evaluation not yet supported');
+    const result = ExpressionEngine.evaluate({ dialect: 'cel', ast: { op: 'value' } }, {});
+    // `EvalResult` is a discriminated union — `error` exists only on the
+    // `ok: false` arm, so narrow on the discriminant before reading it.
+    if (result.ok) throw new Error('expected the engine to refuse an `ast`-only envelope, got a value');
+    expect(result.error.message).toContain('AST-only evaluation not yet supported');
   });
 
   /**