fix(types): stop published declarations importing optional peers; type-check tests in CI

[LinuxDevil]

Closes #346
Closes #244

Summary

#346 — Published .d.ts no longer import optional peers

Consumers running tsc with skipLibCheck: false but without optional peers installed previously hit TS2307/TS7016 on dockerode, @modelcontextprotocol/sdk, etc. Fixed by replacing peer types in public signatures with local structural types:

• src/security/sandbox.ts: Docker.DockerOptions → new exported DockerConnectionOptions structural interface (socketPath/host/port/protocol/TLS/ssh/promise fields). The dockerode import is now type-free in the emitted declarations.
• src/tools/mcp/McpToolLoader.ts: Client from @modelcontextprotocol/sdk → local structural McpClientLike interface covering only the methods the loader actually calls (listTools, callTool, …). Runtime still loads the SDK dynamically.
• src/providers/llm.ts: widened ToolDefinition.function.parameters from Record<string, unknown> to Record<string, unknown> | StandardSchemaV1. This was a genuine public-type bug — every provider (aiSdkCompat, aiSdkProvider, toolSearch) already accepts Zod/Standard Schema/ai.jsonSchema() wrappers at runtime; the declaration was narrower than the implementation.

Verified: after npm run build, dist/index.d.ts and emitted subpath declarations contain no dockerode/@modelcontextprotocol/sdk imports.

#244 (A6b) — type-check tests in CI + strict published-declaration check

• npm run typecheck:tests (tsc -p tsconfig.tests.json) now runs in the main CI job and in the peers/zod4 matrix job, right after npx tsc --noEmit. Test files had drifted from the public API: 133 type errors → 0.
• scripts/pack-smoke.ts: new strict-libs step — after packing, it installs a smoke project, enumerates every export subpath via the now-exported listExports() from scripts/smokeKit.ts, and runs tsc --noEmit with strict: true, skipLibCheck: false, moduleResolution: bundler against each subpath's declarations. Subpaths whose optional peers aren't installed are skipped with a logged reason.
• scripts/smokeKit.ts: listExports() is now exported for reuse.

Strict-libs result:

tsc --noEmit (strict-libs, skipLibCheck: false): declarations of ., ./core, ./tools, ./flows,
./mcp, ./types, ./testing, ./otel, ./hooks, ./auth, ./kv, ./traces, ./triggers, ./vue are clean

Test-file fixes (133 → 0)

~50 test files updated. Fixture-only changes: non-null assertions/optional chaining on mock calls, emptyRunUsage() for usage fixtures, getToolExecute() instead of legacy descriptor fields, required event fields (toolsChanged, runId/seq/timestamp/v), SqlValue casts, AgentConfig/ToolDescriptor fixture corrections, PromiseLike vs Promise helpers, and version-boundary casts for AI SDK mock models. No runtime behavior changed.

Docs: CONTRIBUTING.md documents the new checks; CHANGELOG.md notes both fixes.

Verification

Check	Result
npm run typecheck / typecheck:tests	clean (0 errors, was 133)
npm run build	✅
npm run pack-smoke	✅ incl. strict-libs skipLibCheck: false
npm run test:types	✅
npm test	✅ 4261 passed, 8 skipped
npm run lint	✅
npm run docs:llms:check	✅

Known pre-existing (also fails on main @ 40703023, unrelated to this PR): npm run fallow reports dead-code/dupes/health findings — baseline run shows more findings on the base commit (12 dead-code issues) than on this branch (10).

Notes for reviewers

• BRIEF-2's verification list should add npm run typecheck:tests — it is now part of CI and required to keep tests compiling against the public API.
• The strict-libs step installs the zod major matching our peer range in the smoke project; without it, zod3's own .d.ts generics (not ours) fail under skipLibCheck: false.