chore(lint): anti-slop rungs 4+5 — enable no-unknown-returns and no-chained-type-assertions, fix 73+126 violations

[radandevist]

Part of #1160
Closes #1330

Summary

Lands two rungs of the anti-slop ladder in one PR (precedent: rung 2 shipped five rules at once):

• Rung 4 — anti-slop/no-unknown-returns: enabled at error, all 73 baseline violation sites fixed by naming return types instead of leaking unknown.
• Rung 5 — anti-slop/no-chained-type-assertions: enabled at error, all 126 baseline violation sites (measured 2026-08-24, rule-only config-copy method at base 759aa0109) replaced with canonical patterns.

Why one PR: while rebasing onto fresh develop we found rung 4 had not been merged after all (it lives only on this branch), and the rung-4 fixes are a strict subset of this branch's work — splitting would mean unwinding shared helper extractions for no review benefit.

No suppressions anywhere; every site is genuinely fixed rather than hidden. Also clears the fresh hits that appeared when develop added tenant-users code after our baseline was measured (see last bullet).

CI fix (rebase onto origin/develop)

Model for this fix pass: Ox Alpha via Nous Portal (max effort), driven by jcode.

Rebased onto origin/develop (it gained #1314 moving the staff-user edit route, the #1310 publy/no-iife rule, and #1315). Eight lint errors remained after the rebase; every one is fixed the same way as the rest of this PR — real narrowing or named types, zero suppressions, no allowlist, no rule downgrade:

• $userId-edit.blocker.test.tsx (fix(1301): move ref access out of render in staff user edit route #1314 moved the edit route; 7 hits): adopts this branch's canonical widening helpers — widenOptions<T> (one assert through a named shape) plus an addChildrenOf accessor, matching the sibling real-route suites; the history.block capture shim is typed straight off its bound method (Parameters<typeof originalBlock>[0][]), so it needs no assertion at all; QueryState.refetch returns Promise<void> like the query surface it stubs instead of Promise<unknown>.
• publy/no-iife.ts (lint: add custom publy/no-iife (port from DigitalPrevention) and extract existing IIFEs #1310 landed after our baseline; 1 hit): the brand-new rule carried its own chained assertion inside unwrapCallee; replaced by a single intersection assert (ESTree.Expression & { expression: ESTree.Expression }) naming the member oxlint's ESTree typings omit.
• anti-slop/shared/lexical-type-parameters.ts: the visitor-key record cast stopped compiling against the refreshed @oxlint/plugins typings; swapped for Reflect.get(node, key) — no cast, and the existing isNode guard narrows the result.

Baseline

Rule	Violations	Files
anti-slop/no-unknown-returns	73	46
anti-slop/no-chained-type-assertions	126	75

Canonical replacements (representative)

• Route-object widening in route tests (__root-error-boundary.test.tsx, section-routing.test.tsx, $profileId-edit.test.tsx, layout.test.tsx, tab-routing.test.tsx, …): the TanStack route object exposes .addChildren/beforeLoad/component at runtime but its exported type doesn't name them — each site widens once through a local widenOptions<T> helper instead of as unknown as {…} chains.
• Faithful route mocks (41 factories across route tests): tests read members off Route.options, but most mocked createFileRoute with a factory returning the options object itself, leaving .options undefined at runtime. Every lying factory now returns { ...options, options }, matching the real route object's shape (including where factories attach hook stubs).
• Named return types (rung 4, front + shared-ts production sources): functions that returned bare unknown now return the domain type their callers already expect.
• Fake API errors (router.test.ts): {…} as unknown as Error → Object.assign(new Error('Unauthorized'), { responseStatusCode: 401, … }), matching the existing fake-500 pattern.
• Vendor CSS props in contrast specs (toast-contrast.spec.ts, ×2 sites): style as Record<string, string | undefined> → typed getPropertyValue('-webkit-background-clip') / getPropertyValue('mask-image') access.
• ts-morph narrowing guards (drawer-description-contrast.test.ts, drawer-form.test.tsx): kind-compare + anonymous-shape casts → Node.isFunctionDeclaration(…)-family guards, with a FunctionLikeNode union type predicate so parameter walks stay assertion-free.
• matchMedia stub (vitest.setup.ts): removed the as MediaQueryList cast entirely — the stub returns a structural subset widened once via as typeof window.matchMedia; deprecated addListener/removeListener deleted (verified unused repo-wide).
• Production sources (run-oxlint.ts, iso-analytics.ts, lexical-type-parameters.ts, invitations/index.tsx, profiles.tsx, users.tsx, staff-tenant-users.ts): double casts collapsed to single asserts or removed where inference already suffices; createStaffTenantUserInvitationMutationOptions is now exported and asserted directly under the mocked identity useMutation.
• Kiota untyped bodies (staff-global-tenant-users.ts, code added on develop mid-flight): inline createUntypedObject(…) as unknown as Body → extracted buildAssignCompaniesBody(variables): AssignTenantUserCompaniesForStaffBody naming the wire type once.

Proof

Throwaway const x = {} as unknown as string; at repo root → pnpm lint fires:

proof-cta-violation.ts:1:11: error anti-slop(no-chained-type-assertions): This assertion chain discards type evidence ...

Remove → green. Same probe pattern fires anti-slop(no-unknown-returns) for function f() { return {} as unknown; }.

Gates

Gate	Result
pnpm lint (repo-wide oxlint)	✅ 0 errors post-rebase
pnpm format (oxfmt check)	✅
just ci-drift	✅
pnpm --filter front typecheck	✅
pnpm --filter shared-ts typecheck	✅
pnpm --filter lint-ts typecheck	✅
pnpm --filter shared-ts test	✅ (82/82)
pnpm --filter lint-ts test	✅ (676/676)
pnpm --filter front test	✅ (2393/2393, 220 files)

Model

Ox Alpha via Nous Portal (max effort), driven by jcode

[radandevist]

Round-1 follow-up filed as #1337 (single as-never casts).