Check never runs black/mypy — accepted bundles trip upstream CI lint after publish

[eduralph]

Problem

Publishing accepted bundles as upstream Gramps PRs tripped CI gates the testbed's Check never runs:

• black failed on 7924, 6324, 8622 (Resolve child editors before parent commits (issue #7924) gramps-project/gramps#2449, #2450, #2451).
• mypy failed on 8622 (#2451).

Root cause: the Check gates validate behaviour (C4 red→green, T3 suite) and basic shape (GPL headers, POTFILES via t2_shape/t2_potfiles), but never the two static-analysis gates upstream Gramps CI enforces:

• .github/workflows/black.yml → psf/black@stable (= black --check --diff .)
• .github/workflows/gramps-ci.yml → pip install mypy types-requests then bare mypy (reads the repo's mypy.ini)

So a bundle can reach COMPLETE and be published, only to fail upstream lint — found after the PR is open. The pdca.toml gate config even earmarked this as a "STAGED (not yet ported) black/ruff formatter gate."

Fix

Add a gating T2-lint gate (engine/scripts/ubuntu/run-lint.sh) that applies patch.diff to the pinned upstream worktree in the same Docker image and runs black --check (on the patch's .py) + mypy (whole-tree), with distinct exit codes (1 = lint-dirty/block, 2 = infra, 77 = no core .py). Wire it into Check and re-run it as a pre-push guard in publish.py so a lint-dirty bundle can't open a failing PR.

Related

• Add the dependency "black" to the pdca doctor function #303 (add black to the pdca doctor dependency check) — adjacent but distinct: this gate installs black/mypy inside the container, so it doesn't depend on host doctor tooling. Not closed by this work.