feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

lib/design-md.ts

@@ -179,7 +179,7 @@ export class DesignMdEditRefused extends Error {
 }
 
 /** Does a section heading name the requested section? By canonical name when the request has one, else by exact (case-insensitive) heading. */
-function headingMatches(heading: string, wanted: string, canonical: CanonicalSection | null): boolean {
+function headingMatches(heading: string, wanted: string, canonical: CanonicalSection | null | undefined): boolean {
   return canonical ? canonicalFor(heading) === canonical : heading.trim().toLowerCase() === wanted.trim().toLowerCase();
 }