ci(types): block new TypeScript 7 diagnostics (#10134)

.github/workflows/quality.yml

@@ -275,15 +275,22 @@ jobs:
       # arrives in 7.1, so typescript-eslint / type-coverage / Stryker stay on 6.x
       # (the hybrid is the officially documented pattern). Isolated npx on purpose:
       # installing an alias package could collide node_modules/.bin/tsc with 6.x.
-      # Promote to the blocking gate after ~1 week of parity with the step above.
+      # The full result stays advisory while #8484 has a backlog. The blocking
+      # base-relative ratchet immediately below rejects only diagnostics added by
+      # the PR, so existing release debt does not block unrelated work.
       - name: Typecheck (core) — TS7 native shadow (advisory)
         continue-on-error: true
         run: |
           RC=0
           START=$(date +%s)
-          npx -y -p typescript@7 tsc --pretty false -p tsconfig.typecheck-core.json || RC=$?
+          npm exec --yes --package=typescript@7.0.2 -- tsc --pretty false -p tsconfig.typecheck-core.json || RC=$?
           echo "[ts7-shadow] exit=$RC elapsed=$(( $(date +%s) - START ))s — the 6.x step above stays authoritative"
           exit $RC
+      - name: Typecheck (core) — TS7 zero-new-diagnostics ratchet
+        if: ${{ github.event_name == 'pull_request' }}
+        env:
+          TS7_BASE_REF: ${{ github.event.pull_request.base.sha }}
+        run: npm run check:ts7-diagnostics-ratchet -- --base-ref "$TS7_BASE_REF"
       # TIA: build the impact map at runtime (gitignored, ~21MB) and run only the
       # unit tests impacted by this PR's changed files. On hub/unmapped changes the
       # selector returns __RUN_ALL__ — full-suite authority is the parallel