feat(tools): add a real typecheck step (bun build does not typecheck)

[xmasyx]

Offered in #1614; you said yes to (1).

bun build bundles without typechecking, so a field that is read but never declared compiles cleanly and stays broken silently.

What it does. bun LIFEOS/TOOLS/Typecheck.ts runs tsc --noEmit over two roots: hooks/ + LIFEOS/TOOLS/, and LIFEOS/PULSE/**. Two passes rather than one wider include, because Pulse resolves against its own node_modules.

The configs are generated and deleted. No file named tsconfig.json ever lands at the install root. Bun reads that name at runtime, and one paths/baseUrl/jsx field in it would move the behaviour of every live hook and of the running Pulse server. The generated configs use a non-standard name and are removed in a finally, so runtime invariance is true by construction rather than by discipline. It also means no installer change: one file, nothing to deploy.

Exclusions are printed loudly. PULSE/Observability/** is a standalone Next.js app with its own deps and deserves its own pass; every run says so. Excluded does not mean healthy, it means not looked at. A missing Pulse dir prints skipped and counts as neither pass nor fail.

Verified both ways: exit 1 against this tree, exit 0 against a clean one, generated configs removed in both cases.

What it finds on current main

Reporting rather than fixing, to keep this PR to one file. Happy to send any of them separately.

Two of the four are ones you have already closed at my report, which is the useful part: the step re-derives them from the code alone, with no issue tracker involved.

Already reported and already fixed in your source — listing them because they are still in the published payload, and because they are what the step catches on a cold checkout:

• hooks/ISACloseGate.hook.ts:59 — .filter(unitIsClaimable) hands the array index to the optional second parameter. Filed as ISACloseGate passes unitIsClaimable to .filter(), so its opts parameter receives the array index #1766, closed 6 Aug.
• LIFEOS/PULSE/modules/hooks.ts:142 — the returned object is missing stats, which its own declared type requires. Filed as hooksHealth() returns a flattened object that does not match its declared { status, stats } type #1765, closed 6 Aug.

Not previously reported:

• LIFEOS/TOOLS/SecretScan.ts:228 — error.message on unknown; throws on a non-Error throw.
• LIFEOS/TOOLS/ExtractTranscript.ts and SplitAndTranscribe.ts both import OpenAI from "openai" at top level, and openai is declared in no package.json reachable from LIFEOS/TOOLS/ (only skills/Art/Tools/). Those two fail at runtime on a fresh install, not just here.

Deliberate, and worth a decision rather than a silencer:

• LearningPatternSynthesis.ts:632 → ../../test/lib/hook-replay, and pulse.ts:146 → ./Assistant/module. Both are optional imports guarded by existsSync with a comment saying so (Pulse Assistant tab has no backend: pulse.ts imports missing ./Assistant/module, plus /da vs /assistant naming drift #1419). Correct code that simply cannot resolve in the public payload. If you want this green as a gate, those two need ambient declarations or an explicit allowlist. I left the call to you rather than shipping a suppression mechanism.