chore(lint): forbid bare as casts (blindCast + ratchet), ported from prisma-next

[wmadden-electric]

Imports prisma-next's bare-as-cast enforcement into makerkit, adapted to this repo.

What lands

• Utilities — blindCast<T, "Reason"> / castAs<T> in @makerkit/core/casts, plus assertDefined / invariant in @makerkit/core/assertions as the safe narrowing alternatives.
• Biome plugin — biome-plugins/no-bare-cast.grit fires on every bare as (except as const) in production files, at info severity so it never breaks a build. Test files are exempt; the exclusion regexes mirror this repo's existing overrides test-file patterns.
• CI ratchet — pnpm lint:casts counts plugin diagnostics at HEAD vs the PR base and fails on any per-PR increase. A PR-only cast-ratchet CI job runs it; pnpm test:scripts covers the ratchet itself (8 unit tests).
• Rules docs — .cursor/rules/no-bare-casts.mdc + type-predicates.mdc.

Notes for review

• Self-bootstrapping. The ratchet scans the base in a temp worktree using HEAD's config + plugin (copied in, auto-discovered), so the base is measured under the new rule even though it predates it. The repo's ~43 existing casts become the baseline (delta=0); only new casts fail.
• Config anchoring. Copying the config into each scanned tree (rather than --config-path) is deliberate: it anchors this repo's relative files.includes excludes (!docs, !prisma-next) to the same root for both scans, so the two counts are comparable. An empty .gitignore is dropped into fixture trees that lack one (vcs.useIgnoreFile requires it).
• Credential-free CI. The ratchet job points origin/main at the PR base sha (already in history via fetch-depth: 0), so it needs no authenticated fetch and keeps persist-credentials: false.
• Deliberately dropped from the prisma-next port: as-contract-cast-smell.mdc (about prisma-next's schema-Contract serializer seam, unrelated to makerkit's R6 Contract) and the standalone plugin fixtures dir (the ratchet test is self-contained, avoiding a lint-staged config).

🤖 Generated with Claude Code

[wmadden-electric]

Folded into #13 rather than landing separately. The cast machinery and the R6 cast cleanup now live in #13: R6 no longer adds bare as casts (net -4 vs main), so the ratchet passes there. Keeping it one PR per your call. Closing this.