release(v4.0.2): consumer-strict reader-shape fixes

4.0.1's typecheck gate compiled each package internally against
lib: ["ES2022"]. That doesn't catch types that only fail when
*consumer* code (lib: ["DOM"] + exactOptionalPropertyTypes) tries to
assign a native browser type into one of our locally-defined narrower
types. Dispatch hit one such case in @shade/files inline-threshold.ts.

This release adds a tests/consumer-strict/ smoke project to the
pre-publish gate. It compiles a tiny "as if I were a downstream app"
TS file against:

  lib: ["ES2022", "DOM", "DOM.Iterable"]
  types: ["bun-types"]
  exactOptionalPropertyTypes: true
  strict: true
  paths → packages/*/src/index.ts

scripts/typecheck-all.ts now runs the smoke after per-package checks.
Both must pass before publish:dry / publish:all proceeds.

### Fixed
- @shade/files inline-threshold.ts: MinimalReader<T> rewritten as the
  explicit disjoint union { done:false, value:T } | { done:true,
  value?: T | undefined } that's assignable from every native reader
  shape (bun, DOM, node:stream/web). Fixes the
  "ReadableStreamReadResult is not assignable" Dispatch reported.
- @shade/files streams-bridge (client + server): stash setTimeout
  return in a local before .unref?.() via { unref?: () => void } cast.
  Fluent .unref?.() failed under lib: ["DOM"] (setTimeout returns
  number there).
- @shade/sdk background.ts: same setInterval .unref?.() fix.

Wire-compatible. No API shape changed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/consumer-strict/use-files.ts

@@ -0,0 +1,43 @@
+/**
+ * Consumer-strict smoke for `@shade/files`.
+ *
+ * Compiled with `lib: ["ES2022", "DOM"]` + `exactOptionalPropertyTypes` +
+ * `skipLibCheck: false` to mimic a downstream consumer like Dispatch.
+ * Catches the class of bug where our internal narrower types (e.g. a
+ * locally-defined `MinimalReader`) reject native browser types
+ * (e.g. `ReadableStreamDefaultReader`) the consumer would naturally
+ * pass in.
+ *
+ * If this file fails to compile, the published packages will fail in
+ * any consumer's strict tsc — pre-publish gate must catch it.
+ */
+import { decideInline, type WriteSource } from '@shade/files';
+
+declare const blob: Blob;
+declare const stream: ReadableStream<Uint8Array>;
+declare const bytes: Uint8Array;
+
+async function smoke(): Promise<void> {
+  // Each branch of WriteSource must round-trip through decideInline()
+  // when given the natively-typed inputs a browser app would supply.
+  const sources: WriteSource[] = [
+    bytes,
+    blob,
+    stream,
+    { stream, size: 1024 },
+    { stream, size: 1024, contentType: 'image/png' },
+  ];
+  for (const src of sources) {
+    const decision = await decideInline(src);
+    if (decision.kind === 'streams') {
+      const reader = decision.stream.getReader();
+      const { value, done } = await reader.read();
+      if (!done && value !== undefined) {
+        void value.byteLength;
+      }
+      reader.releaseLock();
+    }
+  }
+}
+
+void smoke;