[00] Setup typescript-strict-plugin baseline + CI gate

[nicobytes]

Description

Bootstrap task for the strict-mode rollout epic #35932. Set up typescript-strict-plugin so individual projects can be switched to strict one at a time, and add a CI check.

This must land before any per-project strict issue.

Acceptance Criteria

• typescript-strict-plugin added as a devDependency in core-web.
• Plugin registered in core-web/tsconfig.base.json (plugins), with an initially empty strict paths list (opt-in per project).
• An tsc-strict script / Nx target is available to run the plugin's checker locally.
• CI runs tsc-strict (non-blocking at first; flip to required once coverage is high).
• core-web/CLAUDE.md documents how to enable strict for a single project and the // @ts-strict-ignore escape-hatch policy.

Priority

High

Additional Context

Approach decided in the rollout plan: opt-in by path with the plugin, never a global strict: true in tsconfig.json (forbidden by core-web/CLAUDE.md). Parent epic: #35932.