feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

browse/src/socks-bridge.ts

@@ -132,7 +132,7 @@ export async function startSocksBridge(opts: {
     clientSocket.once('close', () => inFlight.delete(clientSocket));
 
     let state: State = 'greeting';
-    let buf = Buffer.alloc(0);
+    let buf: Buffer = Buffer.alloc(0);
     let upstreamSocket: net.Socket | null = null;
 
     const killBoth = (reason?: string) => {