`make typecheck` covers 4 packages; CI typechecks 6 — a local green can hide a CI failure

[pdettori]

Problem

The two typecheck matrices disagree.

Makefile:

typecheck:
	cd harness && pnpm exec tsc --noEmit
	cd packages/k8s-sandbox && pnpm exec tsc --noEmit
	cd packages/knative-server && pnpm exec tsc --noEmit
	cd experiments && pnpm exec tsc --noEmit

.github/workflows/ci.yml (Typecheck step) runs the same four plus:

	cd packages/sandbox-relay && pnpm exec tsc --noEmit
	cd packages/ibac-stub && pnpm exec tsc --noEmit

Why it matters

make typecheck is what contributors and agents run as the local gate, and CLAUDE.md documents it as the typecheck command. A change touching packages/sandbox-relay or packages/ibac-stub can therefore be locally green and fail in CI — and the failure surfaces only after a push, which is the slowest possible feedback.

This bit during #188: the branch's local gate was reported as "typecheck clean" on the strength of make typecheck, and the two extra packages had to be run separately by review to establish that the seam change did not affect them (it did not — neither imports it).

Fix

Add the two missing packages to the Makefile target so the local gate matches CI. Better still, drive both from one list so they cannot drift again — e.g. a tsc --build project-references setup, or a small script both the Makefile and CI call.

Acceptance

• make typecheck covers every package CI typechecks.
• The two lists derive from a single source, or a CI check fails if they diverge.

Refs

Found by the whole-branch review of #188 (ST6).