feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

.github/scripts/qualify-dia-macos.ts

@@ -1106,6 +1106,7 @@ export async function qualifyDia(isolation: { root: string; configFile: string }
       comparisonAttempted = true;
       comparisonSource = await runDiaLaunchComparison(account, 'source', { assetRoot: root, executableName, executableSha256: receipt.artifact.executableSha256 },
         undefined, deadline - performance.now());
+      if (!comparisonSource) throw new Error('diagnostic_source_launch_returned_no_result');
       receipt.launchComparison = { mode: 'launch-only', qualificationCredit: false, source: comparisonSource };
       receipt.browsers.source = { stage: 'delegated_comparison', launchReturned: comparisonSource.launchReturned,
         timedOut: comparisonSource.timedOut ?? false, error: comparisonSource.error ?? null };

.github/scripts/run-dia-native-qualification.ts

@@ -429,6 +429,7 @@ async function freshWorker(configFile: string) {
       receipt.reason = 'comparison_chromium_control';
       launchAttempted = true;
       comparisonControl = await runDiaLaunchComparison(account, 'control');
+      if (!comparisonControl) throw new Error('comparison_control_failed');
       receipt.comparisonControl = comparisonControl;
       if (!comparisonControl.ready || !comparisonControl.cleanup?.confirmed) throw new Error('comparison_control_failed');
       receipt.preflight.headlessChromium = true;