fix(maintainer): add .ts extensions so node can run the sweep #1941

Bug

Maintainer Sweep (.github/workflows/maintainer-sweep.yml) has failed every scheduled run since #1890 (98055ca01, 2026-10-23). That PR changed maintainer:sweep and maintainer:scorecard from tsx to node.

Node's type stripper does not resolve extensionless relative imports. The job dies before it assigns anyone:

Error [ERR_MODULE_NOT_FOUND]: Cannot find module
'.../scripts/maintainer/actions' imported from
'.../scripts/maintainer/sweep.ts'

Last green run: 2026-10-23 17:08 UTC, Actions run 39992606331, sha 5651e07e. First failure: run 40026607396. Latest failure: run 40797429460 (2026-10-29).

Fix

1. Add a .ts suffix to every relative import under scripts/maintainer/, including the dynamic import() calls in sweep.test.ts. Leave node: and package imports unchanged. The suffix is .ts, not .js. Node looks up the specifier as written, and ./actions.js is not a file on disk.
2. Set allowImportingTsExtensions: true on the root tsconfig.json. It extends tsconfig.base.json, which already has noEmit: true. Without the flag, tsc -p tsconfig.json reports TS5097. The same flag also covers the six existing .ts imports in scripts/generate-docs.ts and the LLM Gateway scripts.

Do not add .ts extensions under packages/. Those files are compiled to JavaScript.

Keep the package.json scripts on node. That was the point of #1890.

Check

• node scripts/maintainer/sweep.ts --dry-run gets past module loading. A missing token is fine. ERR_MODULE_NOT_FOUND is the bug.
• pnpm exec vitest run --root scripts/maintainer
• pnpm exec tsc -p tsconfig.json --noEmit --pretty false no longer reports TS5097 for these imports.