feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

scripts/eval-input-cache.ts

@@ -105,7 +105,7 @@ function canonical(value: unknown): string {
 export function buildEvalInputIdentity(input: EvalInputManifest): EvalInputIdentityResult {
   try {
     if (!validScope(input.scope)) throw new Error('A repository and positive PR number are required');
-    if (!object(input.coverage) || ['dependencies', 'prompts', 'environment'].some(key => input.coverage[key] !== 'complete')
+    if (!object(input.coverage) || (['dependencies', 'prompts', 'environment'] as const).some(key => input.coverage[key] !== 'complete')
       || !Array.isArray(input.unknownDependencies) || input.unknownDependencies.length !== 0) {
       throw new Error('Consumed input coverage is incomplete or unknown');
     }