[Feature] Tighten CRDT-codec type bounds: Crdt<unknown> not Crdt<any>

[pathosDev]

Size / Priority

• Size: Trivial (~10 sites)
• Category: C.3 Type-Safety.
• Risk: low.

Affected files

• src/crdt/*Codec.ts — CRDT codec functions.
• src/crdt/DistributedData.ts — decodeCrdt returns Crdt<any>.

Background

CRDTs are generic: GCounter, GSet<T>, LWWRegister<T>, etc. The framework's codec functions sometimes use any for the value type:

// src/crdt/DistributedData.ts:49
export function decodeCrdt(json: CrdtJson): Crdt<any> {
  // ...
}

any defeats the type system: callers can do anything with the result without type errors.

The audit suggests Crdt<unknown> — at least the compiler forces a narrowing before use.

Target

Replace any with unknown (or specific generic bounds where possible):

// Before:
export function decodeCrdt(json: CrdtJson): Crdt<any> { ... }

// After:
export function decodeCrdt(json: CrdtJson): Crdt<unknown> { ... }

// Callers:
const crdt = decodeCrdt(json);
// crdt.value has type unknown; user must narrow before using.

Similar replacements in other CRDT codecs.

Integration / risk

• Caller-side changes: callers that did crdt.value.foo directly now need narrowing.
• Internal-only any cases: some internal interfaces may still need any for variance reasons; document each.

Test plan

1. Regression — CRDT tests pass.
2. Compile-time: callers that didn't narrow now error.
3. Per-narrow fix: each erroring caller adds a type-guard.

Acceptance criteria

• any replaced with unknown in CRDT codecs.
• Caller-side type-guards added.
• Tests pass.
• No CHANGELOG entry needed.