feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

tsconfig.test.json

@@ -0,0 +1,19 @@
+{
+  "extends": "./tsconfig.json",
+  "include": [
+    "test/**/*.ts",
+    "test-setup.ts",
+    "browse/test/**/*.ts",
+    "make-pdf/test/**/*.ts",
+    "design/test/**/*.ts",
+    "ios-qa/**/*.test.ts",
+    "ios-qa/daemon/test/**/*.ts",
+    "make-pdf/src/html-to-docx.d.ts"
+  ],
+  "exclude": [
+    "lib/diagram-render/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "test/fixtures/**"
+  ]
+}