feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

lib/cso/process.ts

@@ -6,6 +6,7 @@ import {
   existsSync,
   fstatSync,
   lstatSync,
+  type Stats,
   openSync,
   readSync,
   realpathSync,
@@ -233,10 +234,7 @@ interface BoundedMetadataFile {
   ctimeMs: number;
   content: string;
 }
-function sameMetadataFile(
-  left: BoundedMetadataFile | ReturnType<typeof lstatSync>,
-  right: BoundedMetadataFile | ReturnType<typeof lstatSync>,
-): boolean {
+function sameMetadataFile(left: BoundedMetadataFile | Stats, right: BoundedMetadataFile | Stats): boolean {
   return (
     left.dev === right.dev &&
     left.ino === right.ino &&
@@ -253,7 +251,7 @@ function boundedMetadataFile(
   label: string,
   optional = false,
 ): BoundedMetadataFile | undefined {
-  let before: ReturnType<typeof lstatSync>;
+  let before: Stats;
   try {
     before = lstatSync(path);
   } catch (error: any) {