build: drop tsc entirely and fix sandbox-hostile tests

[thymikee]

Summary

Second-order follow-ups from the tsdown migration (#1087) and CI speedups (#1094): the typescript package is now gone from the toolchain, and the two tests that false-fail in containerized agent environments are fixed.

tsgo everywhere, no tsc:

• pnpm typecheck stays on tsgo (5.3s vs 21.7s for tsc); the typecheck:tsc escape hatch and the typescript devDependency are removed.
• The only remaining compiler-API consumer was args.test.ts, which walks cli.ts to guard dispatch literals. It now uses oxc-parser (same OXC family as oxlint/oxfmt/Rolldown). Before swapping, both implementations were run side by side over cli.ts: identical 14-literal sets. The substitution-free-template case ts.isStringLiteralLike covered is preserved.
• dts bundling already used the tsgo backend; the build is green with no typescript installed.

Sandbox-hostile test fixes (both burned cycles as false failures during the #1087 work):

• The web-provider doctor-guidance test pins Node 24 via the file's existing withNodeRuntimeVersion helper instead of inheriting the host Node — it failed on Node 22, which is the supported engines floor.
• The clean-xcuitest cleanup-failure smoke test skips as root (with reason): chmod 0o500 cannot force a removal failure when the process bypasses directory permissions, the norm in agent containers running check:unit.

AGENTS.md toolchain notes updated to match. Deliberately dropped after review feedback: the Node compile-cache change (measured −6 ms on --help, judged not worth it).

Touched files: 6 (package.json, pnpm-lock.yaml, AGENTS.md, args.test.ts, agent-browser-provider.test.ts, smoke-clean-xcuitest-derived.test.ts).

Validation

Full check:tooling (lint, tsgo typecheck, layering, mcp-metadata, tsdown build incl. dts) green with the typescript package absent. check:unit: 341 files / 3211 tests passing plus smoke 13/13 — in a root + Node 22 container where both fixed tests previously failed, so the fixes are exercised in exactly the environment they target. Fallow audit vs origin/main clean. The oxc-parser port was equivalence-checked against the old TypeScript-API implementation before removal (identical extracted sets).

🤖 Generated with Claude Code

https://claude.ai/code/session_01FqeW8sA2ZnvnftdvpCqFMS

---

Generated by Claude Code

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-07-04 19:02 UTC

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	1.5 MB	1.5 MB	0 B
JS gzip	489.8 kB	489.8 kB	0 B
npm tarball	588.9 kB	588.9 kB	-3 B
npm unpacked	2.1 MB	2.1 MB	-43 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	27.4 ms	27.6 ms	+0.2 ms
CLI --help	52.0 ms	51.3 ms	-0.6 ms

Top changed chunks: no changes in the largest emitted chunks.

[thymikee]

Review status: no actionable blockers found.

I checked the toolchain and sandbox-test changes against the current repo state. The typescript dev dependency and typecheck:tsc script are gone from the root package, the remaining root references are intentional OXC plugin names or documentation, and the example app keeps its own TypeScript dependency separately. The CLI dispatch-literal guard now uses oxc-parser while preserving the old behavior for strict equality, command/member command checks, parentheses, string literals, and substitution-free templates. The web-provider test now pins the intended Node 24 path before checking setup guidance, and the clean-xcuitest failure smoke correctly skips only when root makes the chmod failure impossible.

GitHub checks are green 21/21. Added ready-for-human.