feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

browse/src/security.ts

@@ -174,7 +174,7 @@ export function combineVerdict(signals: LayerSignal[], opts: CombineVerdictOpts
   for (const s of transcriptSignals) {
     const v = classifyTranscript(s);
     if (v === 'block') { transcriptVote = 'block'; break; }
-    if (v === 'warn' && transcriptVote !== 'block') transcriptVote = 'warn';
+    if (v === 'warn') transcriptVote = 'warn';
   }
 
   // Scalar-layer votes.