Typecheck scripts/** and test/isolation, fix the resulting errors

[TheGreatAxios]

Fixes CL-7121 — https://linear.app/abklabs/issue/CL-7121

Problem

bun run typecheck (scripts/run-all.ts typecheck) only runs each workspace package's own typecheck script; the root tsconfig.json (scripts/**/*.ts, eslint.config.ts) and test/isolation/tsconfig.json were never compiled at all. bunx tsc -p tsconfig.json --noEmit on main reports 10 live errors, one a real runtime bug: scripts/e2e/browser/walkthrough.ts:602 reads seeded.workflows on EnsureSeededResult, but the seeded-pending-agents branch (packages/onboarding/src/complete-credential.ts:123) has no workflows field — the walkthrough throws a TypeError instead of surfacing seeded.message.

Change

• package.json: typecheck now chains bunx tsc -p tsconfig.json --noEmit and bunx tsc -p test/isolation/tsconfig.json --noEmit after the per-package run, so bun run typecheck covers everything and CI's dedicated typecheck job (.github/workflows/ci.yml) stays the one that fails — not check:structural, which is a separate job for unrelated heuristics.
• scripts/e2e/browser/walkthrough.ts: branches on seeded.kind, throwing seeded.message for seeded-pending-agents instead of reading a field that doesn't exist there (this feeds the existing retry loop, same as any other transient failure). Also narrows the pageerror handler's error from unknown.
• scripts/checks/browser-safe-subpaths.ts: guards each regex capture group (match[n]) before use instead of asserting it's a string, matching noUncheckedIndexedAccess.
• scripts/run-all.ts: captures the CLI script-name argument in a separately declared const script: string, since the !script early-exit's narrowing doesn't survive into the later closures that read it.
• scripts/e2e/harness.ts / packages/hub-client/src/hub.ts: only spread body into the fetch init when it's defined, per exactOptionalPropertyTypes (the documented spread-literal exception).
• scripts/e2e/smoke-library.test.ts / packages/tool-registry-publish/src/publish.ts: copy bytes into a fresh Uint8Array (Uint8Array.from(...)) before handing them to File/fetch, since their ArrayBufferLike buffer type doesn't structurally match BlobPart/BodyInit's ArrayBuffer under this tsconfig.

Out of scope: apps/web's tsc -b (CL-4613).

Tests

• bunx tsc -p tsconfig.json --noEmit — clean (was 7 errors across 5 scripts files)
• bunx tsc -p test/isolation/tsconfig.json --noEmit — clean
• bunx tsc --noEmit -p packages/hub-client and -p packages/tool-registry-publish — clean
• bun test scripts/run-all.test.ts — 13 pass (orchestration logic itself is unchanged, only the typecheck script string gained two more chained commands, so no new test was needed — this is the stated red/green proof for that piece)
• bun test scripts/checks/test — 131 pass, including browser-safe-subpaths.test.ts
• prettier --check / eslint on every changed file — clean

The machine this ran on was saturated with several other concurrent build lanes, so a full local bun run check across all 83 packages repeatedly got OOM-killed partway through; every package this PR actually touches (hub-client, tool-registry-publish) typechecks clean in isolation, and the orchestration script (run-all.ts) itself is untouched in behavior. CI's typecheck job is the real gate here.