test: close illegal-state escape hatches in spec type-safety (WP-71)

ESLint blanket-exempted every *.spec.ts from the any ban, and no gate
type-checked spec files at all (ng test is transpile-only), so a wrong
cast in a test could never fail the build. 76 `as any` + 12 `as
Extract<>` state-narrowing casts in the three biggest wizard specs read
one variant's fields off a whole-union value: if the reducer returned
the wrong variant, the assertion silently read undefined instead of
failing.

expectTag(state, tag) (libs/shared/src/testing/expect-tag.ts) asserts
and narrows in one call, replacing every one of those casts. Removes
the spec-file any exemption, adds `npm run typecheck` (tsc --noEmit
over each project's tsconfig.spec.json) to CI, and forbids production
code from importing libs/shared/src/testing via dependency-cruiser.
Backend: AanvraagBuilder now models ZaakUrl (closing the last
post-Build() mutation) and guards AtStep; null-forgiving `!` on
endpoint assertions replaced with Assert.NotNull so a null DTO fails by
name, not NullReferenceException.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -75,10 +75,14 @@ jobs:
         if: needs.changes.outputs.frontend == 'true' && steps.node-modules-cache.outputs.cache-hit != 'true'
       - run: npm run lint
         if: needs.changes.outputs.frontend == 'true'
+      - run: npm run typecheck
+        if: needs.changes.outputs.frontend == 'true'
       - run: npm run format:check
         if: needs.changes.outputs.frontend == 'true'
       - run: npm run check:tokens
         if: needs.changes.outputs.frontend == 'true'
+      - run: npm run check:seam
+        if: needs.changes.outputs.frontend == 'true'
 
   frontend:
     needs: changes
@@ -107,6 +111,9 @@ jobs:
       # Showcase snippets must match their real source regions (WP-39, no drift).
       - run: npm run gen:snippets && git diff --exit-code apps/ssp/src/app/showcase/snippets.generated.ts
         if: needs.changes.outputs.frontend == 'true'
+      # Behaviour spec must match the real test names it's generated from (WP-71, no drift).
+      - run: npm run gen:behaviour-spec && git diff --exit-code libs/shared/docs/behaviour-spec.mdx
+        if: needs.changes.outputs.frontend == 'true'
       # Runs the full suite (both apps + both shared libraries, WP-67) AND reports coverage
       # (WP-46, report-only — no thresholds, so it can't fail on coverage; it still fails on
       # a failing test, like `npm test` did).