What does blockchain.address.listunspent exactly return?
Is it safe to assume that every output script is going to be the standard pay-to-hash '76a914' + addr_hash + '88ac' ??


Usually. 

For your example the full scriptPubKey looks like  OP_DUP OP_HASH160 PUSH_20 0x9C1185A5C5E9FC54612808977EE8F548B2258D31 OP_DUP OP_CHECKSIG, but this can also be encoded non-canonically as OP_DUP OP_HASH160 OP_PUSHDATA1 0x14 0x9C1185A5C5E9FC54612808977EE8F548B2258D31 OP_DUP OP_CHECKSIG using a OP_PUSHDATA1 in place of the direct push opcode. There's no functional difference to this and the script will be longer as a result, but there are outputs like this in the unspent outputs database that fit this pattern. 

In total there's 4 valid permutations for each P2PKH script, direct push, OP_PUSHDATA1, OP_PUSHDATA2 and OP_PUSHDATA4. Different software either sees these as valid, or simply ignores, it's undefined exactly what people should be doing with them. They are spendable and technically the same as the most obvious permutation, but it's not clear on the outset that this behavior is even permissible.