feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

design/src/daemon.ts

@@ -533,6 +533,7 @@ export function start(): { port: number } {
     fetch: fetchHandler,
   });
   const actualPort = serverRef.port;
+  if (actualPort === undefined) throw new Error('design daemon did not bind a TCP port');
   const state: DaemonState = {
     pid: process.pid,
     port: actualPort,