feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

lib/cso/verification.ts

@@ -2166,5 +2166,5 @@ export async function verifyRepair(params: {
     validateRepairBundle(persistable, certified.bundle.id, snapshot, params.manifest);
     writeJsonExclusive(join(params.runDir, 'bundles', `${certified.bundle.id}.json`), persistable);
   }
-  return certified;
+  return { manifest: certified.manifest, bundle: certified.bundle };
 }