feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

lib/cso/runtime-catalog.ts

@@ -281,8 +281,9 @@ export function validateRuntimeCatalog(value: unknown): asserts value is Runtime
   } else if (catalog.promotion) throw new Error('INVALID_RUNTIME_PROMOTION');
 }
 
-export const RUNTIME_CATALOG = committedCatalog as RuntimeCatalog;
-validateRuntimeCatalog(RUNTIME_CATALOG);
+const committed: unknown = committedCatalog;
+validateRuntimeCatalog(committed);
+export const RUNTIME_CATALOG: RuntimeCatalog = committed;
 
 export function assertRuntimeCompatible(plan: PreparationPlan, runtime: QualifiedRuntime): void {
   if (plan.schemaVersion !== 1 || plan.status !== 'ready' || runtime.stack !== plan.stack)