feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

package.json

@@ -13,6 +13,8 @@
     "build:cso": "bash scripts/build-cso.sh",
     "format:cso": "prettier --write 'lib/cso/*.ts'",
     "format:cso:check": "prettier --check 'lib/cso/*.ts'",
+    "typecheck": "tsc -p tsconfig.json",
+    "typecheck:test": "bun run scripts/typecheck-test.ts",
     "test:cso:docker": "bun test --max-concurrency 1 test/cso-docker-integration.test.ts test/cso-node-lifecycle-integration.test.ts test/cso-stack-cold-integration.test.ts",
     "test:cso:macos": "bun test test/cso-macos-launcher.test.ts test/cso-registry-socket.test.ts",
     "test:cso:windows": "bun test test/cso-windows-launcher.test.ts",
@@ -90,7 +92,9 @@
   "devDependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.2.117",
     "@anthropic-ai/sdk": "^0.78.0",
+    "@types/bun": "1.4.0",
     "prettier": "3.9.9",
+    "typescript": "7.0.2",
     "xterm": "^5.3.0",
     "xterm-addon-fit": "^0.8.0"
   },