feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

tsconfig.json

@@ -0,0 +1,39 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": [
+      "ESNext",
+      "DOM"
+    ],
+    "types": [
+      "bun"
+    ],
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "allowImportingTsExtensions": true
+  },
+  "include": [
+    "browse/src/**/*.ts",
+    "browse/scripts/**/*.ts",
+    "lib/**/*.ts",
+    "scripts/**/*.ts",
+    "make-pdf/src/**/*.ts",
+    "design/src/**/*.ts",
+    "bin/**/*.ts",
+    "autoplan/bin/**/*.ts",
+    "hosts/**/*.ts",
+    "ios-qa/daemon/src/**/*.ts",
+    "ios-qa/scripts/**/*.ts",
+    ".github/scripts/**/*.ts"
+  ],
+  "exclude": [
+    "lib/diagram-render/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/*.test.ts"
+  ]
+}