ci(solidity): clear the remaining type errors and gate tsc in CI - #4207

Stacked on #4206. The tail of the Node 24 chain: with TypeScript raised to 5.9.3, both solidity packages can be brought to zero tsc errors and held there.

Nothing in CI ran the type checker. yarn lint is eslint, and hardhat transpiles tests without checking them, so a type error only surfaced if someone ran tsc by hand.

What was broken

random-beacon — every error was TS7018 in generated factories. random-beacon/tsconfig.json sets noImplicitAny: true, and typechain 7 emits ABI literals as bare const _abi = [{ inputs: [], ... }]; under that flag an empty array literal infers any[]. So the package was type-checking generated output more strictly than its generator supported, in files nobody can edit.

typechain 8 emits the same literals as const and the class disappears. The alternative — dropping noImplicitAny — would have bought a clean run by checking our own code less, so it is not what this does.

Two notes on the bump:

• @typechain/hardhat is pinned to ^7, not the current ^9, because 9 defaults to the ethers-v6 target and this package is still on v5.
• v8 nests generated modules under their source path instead of emitting flat files, so five deep imports move. Four are Solidity library namespaces (Groups, BeaconDkg) which still have to come from the module of a contract that uses them; the fifth, RandomBeaconGovernance, is an ordinary contract type and now comes from the barrel with its neighbours.

ecdsa — one real bug. submitRelayEntry takes bytes, and the test passed a BigNumber built from 32 random bytes. Beyond not being BytesLike, ethers renders a BigNumber argument through toHexString(), which drops leading zero bytes — so roughly one run in 256 submitted an entry shorter than 32 bytes. The stub only keccak-hashes the value, so nothing failed and nothing noticed. The random bytes are already a Uint8Array, so they now go in directly.

The gate

yarn typecheck (tsc --noEmit -p tsconfig.json) added to both packages, wired into the existing contracts-lint job — which already runs yarn build, and the check needs the generated typechain/ to exist.

Being precise about what this enforces: neither tsconfig sets strict, so zero is zero under the settings the packages already use. random-beacon additionally has noImplicitAny; ecdsa does not, and turning it on there would surface 112 errors (27 in typechain 6 output, 85 hand-written). Raising ecdsa to typechain 8 and then to noImplicitAny is worth doing, separately.

Also ignores .yarn/install-state.gz in ecdsa. yarn install drops 1 MB there and it shows up untracked; random-beacon already ignores it, and the root rule does not apply because a pattern containing a slash is anchored to its own directory.

Verification

Both suites run on the branch, unchanged from before it:

• random-beacon: 955 passing, 0 failing
• ecdsa: 673 passing, 0 failing
• tsc --noEmit: 0 errors in both packages