ci: make typecheck-ratchet base collection robust (fix false positive)

[hblanken]

Problem

The typecheck ratchet (#46) fails PRs that contain no TypeScript changes at all — e.g. the Dockerfile-only #48. Root cause is in the base-baseline collection, not the PRs:

• It ran bun turbo typecheck inside a detached git worktree with symlinked node_modules. turbo/tsgo produce no task output in a linked worktree (it has a .git file, symlinked deps), so the base baseline came back empty.
• collect-type-errors.sh's final grep … | sed | sort -u exits 1 when grep matches nothing — and as the script's last command that propagated out, failing the step under bash -e (contradicting the script's own "always exits 0" header contract).
• Net effect: base baseline empty → every real head error (the fork's ~20 known baseline errors) looks "new" → false failure.

Evidence: on #48 the base step died in 1.5 s (far too fast for a real tsgo run), while the head step — same repo, same script, run in the normal checkout — passed.

Fix

• Collect the base baseline in place: git checkout --detach $BASE_SHA in the same working tree (reusing head's installed node_modules) instead of a linked worktree, so turbo behaves identically for base and head. Head's collector script is copied to $RUNNER_TEMP before the checkout, so the up-to-date collector runs even when BASE predates this fix.
• Honor the "always exits 0" contract in collect-type-errors.sh (|| true + explicit exit 0), and warn to stderr when the typecheck emitted no turbo task lines (i.e. didn't actually run) — so a real tooling failure is visible instead of silently producing an empty baseline.
• Sanity gate in the compare step: base=0 && head>0 means base collection didn't run → fail with a clear diagnostic rather than misreporting N "new" errors.

Verification

• bash -n clean; YAML parses (both jobs + all 6 ratchet steps intact).
• Functional: running collect-type-errors.sh where the typecheck can't run (no bun) now exits 0 and prints the "type checker did NOT run" diagnostic — previously it would exit 1 and fail the step.
• This PR only touches .github/, so head and base TypeScript are identical → expected ratchet result is 0 new errors (and a non-empty base, so the new guard stays quiet).

Follow-up

After merge, rebase #48 onto collab so it re-runs against the fixed gate (also picks up #47) → its typecheck goes green.

🤖 Generated with Claude Code