feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

.github/scripts/run-dia-native-qualification.ts

@@ -429,6 +429,7 @@ async function freshWorker(configFile: string) {
       receipt.reason = 'comparison_chromium_control';
       launchAttempted = true;
       comparisonControl = await runDiaLaunchComparison(account, 'control');
+      if (!comparisonControl) throw new Error('comparison_control_failed');
       receipt.comparisonControl = comparisonControl;
       if (!comparisonControl.ready || !comparisonControl.cleanup?.confirmed) throw new Error('comparison_control_failed');
       receipt.preflight.headlessChromium = true;