build(dts): TS2883 on GLOBAL_FLAG_KEYS prints ##[error] on every build, including green runs on main

[thymikee]

pnpm build's declaration step emits a GitHub ##[error] annotation on every run — green ones included:

##[error]src/commands/cli-grammar/flag-groups.ts(99,14): error TS2883: The inferred type of 'GLOBAL_FLAG_KEYS'
cannot be named without a reference to 'ReplayRequestFields' from
'../../../node_modules/@agent-device/contracts/src/replay-request-fields.ts'. This is likely not portable.
A type annotation is necessary.

Confirmed on successful main runs 32177253955 and 32172571670, and on green PR runs (e.g. #1861 job 95986110381) — it is not caused by any PR in flight, and nothing fails because of it. tsdown continues and emits dist/.

Why it is worth fixing rather than tolerating:

• AGENTS.md says declaration generation via the TS7 native executable is stricter than a plain typecheck, and that a failure there means inspecting tsconfig.lib.json / tsdown.config.ts — so this is precisely the signal that guidance tells us to read, currently normalized as noise.
• A permanent ##[error] annotation on every build trains everyone to ignore that annotation, which is where a genuine dts failure will hide.
• TS2883 means the emitted declaration for GLOBAL_FLAG_KEYS is not portable across the package boundary; consumers resolving @agent-device/contracts differently can get a broken or widened type.

Site (src/commands/cli-grammar/flag-groups.ts:99):

export const GLOBAL_FLAG_KEYS = new Set<FlagKey>([...]);

FlagKey comes from ./flag-types.ts and transitively reaches ReplayRequestFields in @agent-device/contracts. The error's own remedy applies — an explicit ReadonlySet<FlagKey> (or Set<FlagKey>) annotation on the export, so the emitted type names FlagKey rather than inferring through the contracts path. Worth confirming with pnpm check:tooling that nothing else in the same family needs the same treatment.

Found while babysitting the #1781 wave-3 PRs; unrelated to their diffs.