ci: typecheck the root script/ directory #47

Nothing in CI typechecks script/*.ts. bun typecheck runs turbo typecheck over workspace packages, and script/ is not one; the root tsconfig.json has no Bun types, so tsc -p tsconfig.json cannot check it either (every Bun/process/bun:test reference is an error).

That matters because script/ holds the fork's CI guards (check-workflow-guards.ts, github/same-repo-guard.ts, ...) and now sync-upstream.ts (#46). A type error there only surfaces at runtime.

Found while landing #46, where the new files were checked by hand with a throwaway tsconfig (extends ./tsconfig.json, types: ["bun"], typeRoots pointed at a package's @types). That check found three real noUncheckedIndexedAccess errors that tests did not.

Suggested fix: a script/tsconfig.json with Bun types plus a typecheck step for it (either a small workspace package or a step in typecheck.yml), then fix whatever the existing scripts fail on. Note typecheck.yml::typecheck is digest-pinned in check-workflow-guards.ts, so that digest needs a deliberate update.

Refs #46