chore(tooling): explicitly typecheck coverage verdicts

[thymikee]

Summary

Typecheck coverage verdict tooling through explicit root includes while retaining full layering checks for scripts. Fix the compiler errors exposed by the new roots.

Six files changed. Review follow-up replaces duplicate exact-list pins with one root-region contract: existing application/declaration roots stay fixed; additional roots beneath scripts/ need only a tsconfig edit. Normalized paths cannot escape the scripts region.

Validation

Tested head: deac2ba071c67e29cd43e15c87f48df6eb91fd68; rebased onto 22ae872676, including the shared Coverage repair (#3653).

• pnpm check:affected --base 22ae872676 --head deac2ba071 --run: passed.
• Project-reference/layering tests: 21 passed.
• Planted configurations: a new scripts family passed; unsupported roots, root exclusions, and scripts-prefixed traversal were rejected. All planted changes were removed.
• Original compiler-error mutations were rejected by typecheck; explicit roots covered all 13 matched coverage-tooling files (11 newly compiled).

Full scripts R11 enforcement remains enabled. This is tooling-only; device validation does not apply. CI must pass on this head before merge.

[cubic-dev-ai]

No issues found across 6 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	5.24 MB	5.25 MB	+12.0 kB
Package (unpacked)	5.24 MB	5.25 MB	+12.0 kB
Package (download)	1.57 MB	1.58 MB	+3.5 kB

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	27.0 ms	27.4 ms	+0.4 ms
CLI --help	78.5 ms	76.1 ms	-2.4 ms

[thymikee]

I found no code problems at be09933, but CI had not finished when I looked. Lint & Format (the tsc typecheck) and Repo Guards (the layering R11 tests) are the two jobs that cover this diff. Coverage and the smoke tests were also queued, and the diff does not touch their routes. I did not run the typecheck or the tests myself, so the pnpm check:affected result and the planted-failure experiments in the description are not confirmed on my side. I also did not check which two of the 13 matched files were already compiled transitively. The next step is for CI to finish green on Lint & Format and Repo Guards. Not blocking: the test "explicit tooling roots record the conservative compiled-set divergence" in scripts/layering/project-references.test.ts (https://github.com/callstack/agent-device/blob/be09933/scripts/layering/project-references.test.ts#L97) repeats the exact list that the test at line 65 already pins, so it cannot fail alone, and you can take or leave that. Since insideCompiledSources returns false for every scripts/ path, any scripts/ root is fail-closed by construction. Could the two exact-list pins become one check that every root include entry is src, test, the shared global.d.ts, or under scripts/, so later tooling families only need a tsconfig.json edit?

[thymikee]

Applied the root-region simplification at deac2ba071c67e29cd43e15c87f48df6eb91fd68: one assertion retains the application/declaration roots and permits normalized roots under scripts/; the duplicate exact scripts list is gone. insideCompiledSources remains unchanged, so scripts retain full R11 checking.

Validated the contract with planted configs: an additional scripts family passes, while an unsupported root, root exclusion, and scripts/../tools escape fail. The 21 project-reference/layering tests and the full affected gate passed on this head. The original compiler inventory includes all 13 matched files; scripts/coverage-crap/stamp.ts and scripts/vitest-coverage-run-stamp-reporter.ts were already compiled transitively, leaving 11 newly compiled files. The branch also includes main's shared Coverage-gate repair from #3653. New-head CI is pending.

[thymikee]

Checked the successful Size job for deac2ba071c67e29cd43e15c87f48df6eb91fd68. The JavaScript bundle delta is 0 bytes. The entire +11,983-byte unpacked difference is dist/apple/snapshot-presentation/Sources/AgentDeviceSnapshotPresentation/SnapshotPresentedSurface.swift.

CI compared against newer base 35c21b618ace55f2313124190d5674ea174e6d8b, which includes the Apple simplification from #3632. That Apple file is unchanged between this PR's merge base 22ae872676213b27aeb97aeea1c83bbdecac9360 and its head. This is upstream base advancement outside the tooling diff, so the size report requires no code correction. Remaining checks are still pending.

[thymikee]

This is ready at deac2ba. The earlier Coverage failure came from the stale APPROVED_OVER_CEILING row, which the PR body says #3653 and the rebase fixed, and I found no code change still needed. CI is still pending with no failed jobs, and Lint & Format and Repo Guards are the two that exercise this diff, so they need to finish green before merge. I did not run tsc or the layering tests myself, so the typecheck result rests on that CI run. There are no conflicts.

Not blocking: the explicit type argument on parseArgs in scripts/lib/cli-args.ts looks unneeded, because the (values as { help?: boolean }).help cast alone seems to fix the TS2339 error. It also restates the help option that the declared return type already covers. You can take this or leave it.