#238 chore(dev): enforce agent readiness with TypeScript 7 and Oxlint

Agents need repeatable setup, executable ownership boundaries, and completion checks that exercise the running API. This PR supplies those gates, upgrades both TypeScript packages to TypeScript 7, and makes correctness and promise handling part of the required lint workflow.

Changes

• Add locked setup, server and SDK checks, disposable Postgres/Redis verification, CI evidence, and contributor instructions.
• Promote post-dispatch coherence failures to typed unknown outcomes with inspect-state guidance and recover the affected worker before propagating the error; never replay the execution. Harden cleanup and prove abort/recovery behavior.
• Retain redacted request/response evidence before contract failures, report schema counts, and keep Python auth bodies in a private pipe without disk or stdout capture. Add text-schema regressions, checker bypass fixtures, and a reproducible dated audit snapshot.
• Centralize typed worker commands, script completion, and outcome recovery. Keep reservations within each pool and preserve primary failures and unknown-outcome replay restrictions.
• Enforce worker ownership boundaries and validate observed HTTP and SDK traffic against OpenAPI. CI runs worker-failure, SSE-finalization, input-budget, and tenant harnesses.
• Pin TypeScript 7.0.2 in the server and SDK and migrate the architecture checker to its native compiler APIs. Follow resolved symbols, scan source excluded by tsconfig, and close compiler sessions. Driver-fault tests still use real child processes.
• Consolidate this PR's six patch changesets into one entry documenting runtime recovery, dependency updates, scope behavior, and the public ECOHERENCE-to-EEXEC_OUTCOME_UNKNOWN change.
• Keep Biome and add Oxlint's native correctness baseline, array callback checking, four type-aware promise/spread rules, and four Vitest integrity rules. Retain the selected anti-slop rules and pinned, licensed upstream sources. Install the independent SDK lockfile before CI linting.
• Observe asynchronous scope initialization and callback failures. Lease-renewal callbacks handle unexpected rejection conservatively; Redis transient retry behavior and read/write error classification remain intact. Preserve snapshots while iterating collections that callbacks mutate, and normalize all HeadersInit representations in SDK test fixtures.

Scope

• Main requires 12 GitHub Actions checks, an up-to-date branch, and one approval. Existing administrator bypass remains enabled.
• OpenAPI validation covers observed operations, statuses, media types, JSON bodies, and text string schemas. Parameter schemas and SSE event schemas retain separate behavior coverage.
• Type-aware lint covers server and TypeScript SDK code; scripts receive syntax checks. Assertions attached before a concurrency barrier and awaited later remain valid. The chosen policy and fixture exceptions are documented in tools/oxlint/anti-slop/README.md.
• TypeScript 7 compiler APIs used by the checker are unstable; the exact version and negative fixtures constrain upgrades.
• Existing development dependency advisories remain documented in SECURITY.md. The production dependency gate has one known moderate advisory.

Verification

• Hosted checks: 2,288 core tests, 57 script checks, 152 TypeScript SDK tests, and 174 Python SDK tests passed, plus types, formatting, native TypeScript builds, and Python 3.9 type compatibility.
• Hosted pnpm verify:architecture: 258 integration tests with zero skips and 723 live checks passed (92 HTTP/MCP, 102 SDK, 110 worker-failure, 109 stream-finalization, 283 budget, 27 tenant checks). All owned verification resources were cleaned up.
• One local full run hit the existing 100 ms cancellation-prefix timing assertion. All eight cancellation tests passed in isolation, and the unchanged full rerun passed; timeouts and worker counts were preserved.
• Heartbeat rejection regression tests fail in all three lease modes on the previous implementation and pass on the new implementation. CLI fixtures prove the selected lint rules reject their target patterns.
• pnpm security:audit passed the production high/critical gate. Full development audit findings remain unchanged; none of the reported paths involve the new TypeScript/Oxlint tooling.
• CI YAML parses, and a Luna review found no blocking correctness or policy regressions. All 12 required hosted checks passed on final head 5161e4f, including the expanded architecture profile. All 25 requested review threads were addressed and resolved. Full integration completion relies on hosted CI at the user's request. Focused local verification passed 32 worker-outcome tests and 28 script tests, Python formatting/lint, and staged style, Oxlint, and type checks. The recovery regression failed on the prior code because the worker was not retired and passes after the fix without manual caller recovery.