[no-ticket] Catch nullable values laundered through TypeScript assertions

[bockets]

BiggiePockets reviewed and approved PRs #30877, #30879, #30880, #30881, and
#30883 in BiggerPockets/biggerpockets (a React port of the /notifications
page). The page then crashed on first load in a review app:

TypeError: Cannot read properties of null (reading 'charAt')

The root cause: colleague_requests.status and referenceships.status are
nullable columns in db/schema.rb (no null: false), and real rows carry
NULL. app/serializers/api/v3/notification_serializer.rb passed the column
straight through (status: parent.status). frontend/api/notifications/index.ts
declared status: string — not string | null — and laundered the null
through an unchecked assertion, status: raw.status as string. A component
then called status.charAt(0), threw, and the throw hit React Router's error
boundary, blanking the entire page rather than just the one notification
card. Test factories always set a status, so no spec caught it, and the
review missed it too.

This adds prompts/_shared/nullability-boundary-rules.md and wires it into
both review stages (codex-first-pass.md, claude-synthesize.md,
claude-synthesize-thesis-first.md):

• Check the actual nullability of a value at its source (db/schema.rb) when
  it crosses a DB column → serializer → TypeScript API type → component
  boundary, rather than trusting a declared type further down the chain.
• Treat an unchecked as assertion that narrows a nullable value to a
  non-null TypeScript type as a finding unless it's justified against the
  real schema/serializer.
• Weigh blast radius: a throw inside a component subtree under an error
  boundary (React Router's route boundary, or an explicit ErrorBoundary)
  takes down everything the boundary covers, not just the failing element.

Also adds the file to the prompts/ tree listing in README.md.