feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

lib/aside-render.ts

@@ -296,7 +296,7 @@ export function serveDir(root: string, nonce: string = randomBytes(16).toString(
 // ─── Async spawn (keeps the loopback server's event loop free) ────────────────
 
 async function runProc(cmd: string, args: string[], timeoutMs: number): Promise<{ code: number | null; stdout: string; stderr: string; error?: string }> {
-  let child: ReturnType<typeof Bun.spawn>;
+  let child: Bun.Subprocess<'ignore', 'pipe', 'pipe'>;
   try {
     child = Bun.spawn([cmd, ...args], { stdout: 'pipe', stderr: 'pipe', stdin: 'ignore' });
   } catch (e) {
@@ -608,7 +608,7 @@ export const NO_BROWSER_HELP = "open the Aside app (macOS 15+, aside.com), or ru
 export type EngineChoice =
   | { engine: 'aside'; version: string }
   | { engine: 'browse'; bin: string }
-  | { engine: null; probe: AsideProbe; error: string };
+  | { engine: null; probe: Extract<AsideProbe, { ok: false }>; error: string };
 
 let chosen: EngineChoice | undefined;
 

lib/cso/preparation-container.ts

@@ -802,9 +802,10 @@ async function extractNpmArchive(
         fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL,
         0o600,
       );
-      current = { remaining: size, padding: (512 - (size % 512)) % 512, fd, mode: safeMode || 0o600 };
+      const mode = safeMode || 0o600;
+      current = { remaining: size, padding: (512 - (size % 512)) % 512, fd, mode };
       if (!size) {
-        fs.fchmodSync(fd, current.mode);
+        fs.fchmodSync(fd, mode);
         fs.closeSync(fd);
         current.fd = undefined;
         if (!current.padding) current = undefined;

lib/cso/process.ts

@@ -6,6 +6,7 @@ import {
   existsSync,
   fstatSync,
   lstatSync,
+  type Stats,
   openSync,
   readSync,
   realpathSync,
@@ -233,10 +234,7 @@ interface BoundedMetadataFile {
   ctimeMs: number;
   content: string;
 }
-function sameMetadataFile(
-  left: BoundedMetadataFile | ReturnType<typeof lstatSync>,
-  right: BoundedMetadataFile | ReturnType<typeof lstatSync>,
-): boolean {
+function sameMetadataFile(left: BoundedMetadataFile | Stats, right: BoundedMetadataFile | Stats): boolean {
   return (
     left.dev === right.dev &&
     left.ino === right.ino &&
@@ -253,7 +251,7 @@ function boundedMetadataFile(
   label: string,
   optional = false,
 ): BoundedMetadataFile | undefined {
-  let before: ReturnType<typeof lstatSync>;
+  let before: Stats;
   try {
     before = lstatSync(path);
   } catch (error: any) {

lib/cso/runtime-catalog.ts

@@ -281,8 +281,9 @@ export function validateRuntimeCatalog(value: unknown): asserts value is Runtime
   } else if (catalog.promotion) throw new Error('INVALID_RUNTIME_PROMOTION');
 }
 
-export const RUNTIME_CATALOG = committedCatalog as RuntimeCatalog;
-validateRuntimeCatalog(RUNTIME_CATALOG);
+const committed: unknown = committedCatalog;
+validateRuntimeCatalog(committed);
+export const RUNTIME_CATALOG: RuntimeCatalog = committed;
 
 export function assertRuntimeCompatible(plan: PreparationPlan, runtime: QualifiedRuntime): void {
   if (plan.schemaVersion !== 1 || plan.status !== 'ready' || runtime.stack !== plan.stack)

lib/cso/verification.ts

@@ -2166,5 +2166,5 @@ export async function verifyRepair(params: {
     validateRepairBundle(persistable, certified.bundle.id, snapshot, params.manifest);
     writeJsonExclusive(join(params.runDir, 'bundles', `${certified.bundle.id}.json`), persistable);
   }
-  return certified;
+  return { manifest: certified.manifest, bundle: certified.bundle };
 }

lib/design-md.ts

@@ -179,7 +179,7 @@ export class DesignMdEditRefused extends Error {
 }
 
 /** Does a section heading name the requested section? By canonical name when the request has one, else by exact (case-insensitive) heading. */
-function headingMatches(heading: string, wanted: string, canonical: CanonicalSection | null): boolean {
+function headingMatches(heading: string, wanted: string, canonical: CanonicalSection | null | undefined): boolean {
   return canonical ? canonicalFor(heading) === canonical : heading.trim().toLowerCase() === wanted.trim().toLowerCase();
 }