Restore static type checking (mypy removed; ruff ANN not enabled)

[tschm]

Summary

There is currently no static type checking in the repo. mypy has been removed entirely (no references in pyproject.toml, CI workflows, or pre-commit), and ruff's ANN (flake8-annotations) rule set is not selected. As a result nothing enforces type correctness or annotation completeness.

Evidence

• grep -rl mypy over *.toml/*.yml/*.yaml/*.cfg returns nothing.
• ruff.toml select/extend-select does not include ANN.
• ~30 of 156 functions in src/ lack a return annotation (~81% annotated).

Why it matters

This is a regression — type checking was previously part of the toolchain. A typed CLI with model dataclasses (models/lock.py, models/template.py, models/bundle.py) benefits significantly from static verification.

Proposed fix

• Add mypy to a [dependency-groups] entry (e.g. lint or a new type group) and a CI step, or
• Enable ruff ANN to enforce annotation completeness (lighter-weight), or both.

Acceptance criteria

• Static type checking runs in CI and/or pre-commit
• Configuration documented in CONTRIBUTING / development docs