test: close illegal-state escape hatches in spec type-safety (WP-71)

ESLint blanket-exempted every *.spec.ts from the any ban, and no gate
type-checked spec files at all (ng test is transpile-only), so a wrong
cast in a test could never fail the build. 76 `as any` + 12 `as
Extract<>` state-narrowing casts in the three biggest wizard specs read
one variant's fields off a whole-union value: if the reducer returned
the wrong variant, the assertion silently read undefined instead of
failing.

expectTag(state, tag) (libs/shared/src/testing/expect-tag.ts) asserts
and narrows in one call, replacing every one of those casts. Removes
the spec-file any exemption, adds `npm run typecheck` (tsc --noEmit
over each project's tsconfig.spec.json) to CI, and forbids production
code from importing libs/shared/src/testing via dependency-cruiser.
Backend: AanvraagBuilder now models ZaakUrl (closing the last
post-Build() mutation) and guards AtStep; null-forgiving `!` on
endpoint assertions replaced with Assert.NotNull so a null DTO fails by
name, not NullReferenceException.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/ci-local.sh

@@ -12,14 +12,17 @@ cd "$(dirname "$0")/.."
 step() { printf '\n\033[1;36m▶ %s\033[0m\n' "$1"; }
 
 step "lint";                      npm run lint
+step "typecheck (spec files)";    npm run typecheck
 step "dependency boundaries";     npm run dep:check
 step "format:check (prettier)";   npm run format:check
 step "check:tokens";              npm run check:tokens
+step "check:seam";                npm run check:seam
 step "test (vitest + coverage)";  npm run test:coverage
 step "build --localize (nl+en)";  npx ng build ssp --localize && npx ng build behandelportal --localize
 step "npm audit (shipped deps)";  npm audit --omit=dev
 step "backend format + tests";    ( cd backend && dotnet format BigRegister.slnx --verify-no-changes && dotnet test BigRegister.slnx --filter "Category!=Integration" )
 step "showcase snippets drift";   npm run gen:snippets && git diff --exit-code apps/ssp/src/app/showcase/snippets.generated.ts
+step "behaviour spec drift";      npm run gen:behaviour-spec && git diff --exit-code libs/shared/docs/behaviour-spec.mdx
 step "api-client drift";          npm run gen:api && git diff --exit-code libs/shared/src/infrastructure/api-client.ts backend/swagger.json
 
 if [[ "${1:-}" == "--full" ]]; then