Problem

Two measured gaps in the type/lint hardening:

1. typescript/no-floating-promises is not enabled in .oxlintrc.json (only no-misused-promises is). A repo-wide type-aware probe shows the entire codebase is already clean except 3 hits in the generated apps/shared/OpenClawKit/Sources/OpenClawKit/Resources/CanvasA2UI/a2ui.bundle.js bundle. Nothing currently prevents the first unawaited-promise regression (swallowed errors, races) in an async-heavy gateway codebase.

2. Node-side code typechecks against browser globals. tsconfig.core.json includes src/, ui/, and packages/ in one program, so the base lib: ["DOM", "DOM.Iterable", "ES2023"] gives server code window/document/navigator. A probe compiling src/ + packages/ with lib: ["ES2023"] shows exactly 1 trivial error (a TS4058 declaration-naming nit in src/secrets/config-io.ts) — the hardening is nearly free. Extensions legitimately need DOM (browser/canvas/diffs plugins) and keep it.

Proposed fix

• Enable typescript/no-floating-promises as error; consolidate the three per-path a2ui.bundle.js oxlint ignores into one glob covering the generated bundles.
• Split the core lane: tsconfig.core.json becomes the Node-side program (src/ + packages/, lib: ["ES2023"]); new tsconfig.ui.json owns ui/** with DOM. Wire tsgo:ui into tsgo:prod, project references, and check:changed routing. Root tsconfig.json stays unchanged for the IDE.

Follow-up to #104313 / #104348.