Typecheck the TypeScript SDK in CI

[macanderson]

The TS SDK type changes in PR #87 (KnownFrameKind, KNOWN_FRAME_KINDS, isKnownFrameKind, FrameKind = KnownFrameKind | (string & {})) were not typechecked — no local toolchain and npx tsc failed in that environment. sdk/typescript/ has a tsconfig.json and a package.json but nothing in CI appears to run tsc --noEmit against it.

An SDK that is only checked by eye is one refactor away from shipping broken types to whoever ports from it.

Add a CI job running tsc --noEmit on sdk/typescript/, and check whether sdk/python/ gets equivalent coverage (mypy/pyright).

Definition of done

• CI runs tsc --noEmit against sdk/typescript/ in a job of its own, one
  that does not first pay for the Rust build.
• sdk/typescript typechecks clean under exactly the command CI runs.
• The TypeScript typecheck is shown to fail on a deliberate type error and
  to pass again once it is reverted, with both outputs quoted in the PR.
• Whether sdk/python/ gets equivalent coverage is decided explicitly: a
  mypy/pyright job is added, or the PR description says why not.
• sdk/python typechecks clean under exactly the command CI runs.
• The Python typecheck is shown to fail on a deliberate annotation error and
  to pass again once it is reverted, with both outputs quoted in the PR.
• Every version or tool the new jobs depend on is either pinned or the
  comment beside it says why it floats.
• CHANGELOG.md records the new jobs under [Unreleased].