feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

hosts/claude/hooks/auq-error-fallback-hook.ts

@@ -132,7 +132,7 @@ export function sessionKind(cwd?: string): 'spawned' | 'headless' | 'interactive
       timeout: 3000,
       cwd: cwd && fs.existsSync(cwd) ? cwd : undefined,
     });
-    const out = (res.stdout || '').trim();
+    const out = String(res.stdout || '').trim();
     if (out === 'spawned' || out === 'headless' || out === 'interactive') return out;
   } catch (e) {
     logHookError(`sessionKind failed: ${(e as Error).message}`);