fix: address independent review findings

tests/test_service.py

@@ -256,6 +256,34 @@ class ServiceTestCase(unittest.TestCase):
                 idempotency_key="premature-gate",
             )
 
+    def test_evidence_and_findings_items_must_be_objects(self) -> None:
+        self.issue()
+        self.service.claim_work_package(
+            self.principals["lead"],
+            project_id="sandbox",
+            work_package_id="WP-001",
+            idempotency_key="claim",
+        )
+        with self.assertRaises(ValidationError):
+            self.service.submit_result(
+                self.principals["lead"],
+                project_id="sandbox",
+                work_package_id="WP-001",
+                summary="Invalid evidence.",
+                evidence=["not-an-object"],  # type: ignore[list-item]
+                idempotency_key="invalid-evidence",
+            )
+        with self.assertRaises(ValidationError):
+            self.service.submit_review(
+                self.principals["reviewer"],
+                project_id="sandbox",
+                review_id="rev-does-not-matter",
+                verdict="APPROVE",
+                findings=[42],  # type: ignore[list-item]
+                summary="Invalid findings.",
+                idempotency_key="invalid-findings",
+            )
+
     def test_idempotent_replay_and_key_mismatch(self) -> None:
         first = self.service.issue_work_package(
             self.principals["pm"],