chore(deps): take TypeScript 7 for the typecheck gate

[nzneit]

Stacked on #4 (chore/dep-bumps). Base is that branch, not main, because both touch bun.lock. Merge #4 first and GitHub retargets this to main automatically. The diff shown here is this commit alone.

No CI run on this PR yet, by configuration. .github/workflows/ci.yml triggers on pull_request: branches: [main], so a PR based on another branch does not fire the gates job. It will run as soon as this retargets to main. Until then the verification below is local: all five gates exit 0, run with the same commands and ordering as the gates job.

Raises the typescript devDependency from ^5.6.0 to ^7.0.2 — the native (Go) port, released 2026-07-08. This discharges D-021's third deferred obligation and is recorded as D-022.

One line of package.json plus the lockfile. No source changes, no tsconfig.json changes, no CI changes: only the compiler behind tsc --noEmit moves. The lockfile diff is exactly typescript plus its 20 platform binaries, nothing else moved.

Measured, not taken from the speed claim

• The full gate set exits 0 under 7.0.2: check-docs, lint, typecheck, demo-app:build, bun test (432 pass, 0 fail).
• The gate is live, not silently narrowed. A planted error in each tsconfig include root exits 1 while the clean tree exits 0: a type mismatch in src/, a strictNullChecks violation in src/, a mismatch in test/, and a bad JSX element in demo-app/. This is the check that actually matters here, because a fast pass and a skipped pass look identical from the exit code alone.
• Both compilers agree on this tree: 5.9.3 and 7.0.2 each exit 0 on the unmodified working tree, so the speedup is not being bought with lost coverage.
• Wall clock, 3 runs each: 5.9.3 = 1167 / 1138 / 1163 ms, 7.0.2 = 110 / 107 / 132 ms.
• No cross-platform hazard. The 20 @typescript/typescript-<platform> packages are optionalDependencies carrying os/cpu constraints, so each host installs only its own, and all 20 are recorded in bun.lock. A darwin or win32 contributor resolves theirs from the same lockfile.

One consequence worth knowing about

TypeScript 7 ships tsc and nothing else. Its lib/ contains tsc.js, getExePath and version — there is no tsserver.js and no programmatic typescript module API.

Verified that the repo is unaffected: nothing under src/, test/, scripts/, demo-app/ or bin/ imports typescript as a module; stryker.conf.json configures no checkers, so mutation runs never load it either; and no .vscode/.zed setting pins a workspace tsdk.

The consequence that does land is on editors. Anyone whose editor is set to "use the workspace TypeScript version" will not find a language server under node_modules/typescript/lib and will fall back to the editor's own bundled TypeScript, which means the editor and the gate can be running different compilers. That is a per-developer setting rather than a repo one, so AGENTS.md records it (with bun run typecheck as the authority when they disagree) instead of working around it.

Still open from D-021

Obligation (1) aedes 1.x, behind R-006/R-007, and obligation (2) @biomejs/biome 2.x, with the biome migrate landmine documented in #4. Both unaffected by this change.