feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

bin/gstack-design-md.ts

@@ -93,7 +93,7 @@ export function main(argv = process.argv.slice(2)): number {
     }
     case 'mark': {
       const choice = positional[0] as FormatChoice | undefined;
-      if (!(FORMAT_CHOICES as readonly string[]).includes(choice)) {
+      if (!choice || !(FORMAT_CHOICES as readonly string[]).includes(choice)) {
         process.stderr.write(`usage: gstack-design-md.ts mark <${FORMAT_CHOICES.join('|')}> [DESIGN.md]\n`);
         return 2;
       }

bin/gstack-gbrain-sync.ts

@@ -75,7 +75,10 @@ interface CodeStageDetail {
     | "failed"
     | "refused-autopilot"
     | "refused-reclone"
-    | "refused-egress-receipt";
+    | "refused-egress-receipt"
+    | "skipped-policy-read-only"
+    | "refused-policy-deny"
+    | "refused-policy-unreadable";
 }
 
 interface StageResult {