ci: add ty type checking (warn-first ratchet)

[tomchop]

Summary

Adds Astral's ty as the project type checker, replacing the unused mypy dev dependency. Phase 1 (static schema unions, #1285) is what makes type checking actually useful here — before it, every -> ObservableTypes was statically an empty tuple.

ty is beta (0.0.x — "diagnostics may change between any two versions"), so it's pinned via uv.lock and CI uses the locked version, exactly like ruff. Bumping it is a deliberate lockfile change.

Rollout: broad scope, warn-first

ty runs over all of core/. The ~16 rules that currently fire on the (previously un-type-checked) legacy code are downgraded to non-blocking warn in [tool.ty.rules], while every other ty rule stays enforced at error. CI runs ty check --exit-zero-on-warning:

• warnings are visible in the job logs but don't fail CI;
• any error-level diagnostic fails the job.

296 diagnostics today, 0 error-level after the warn config. The ratchet is to fix a rule's instances and flip it back to error, one rule at a time.

What's here

• ty>=0.0.59 in the dev group; mypy removed; relocked.
• [tool.ty]: python-version = "3.13", src.include = ["core"], and the 16 warn rules (each annotated with its current count).
• .github/workflows/typecheck.yml: full uv sync --group dev (ty needs real dependency types — pydantic/fastapi/arango) + uv run ty check --exit-zero-on-warning.

Ratchet backlog (follow-up PRs)

• unsupported-operator (15) — includes genuine x not in None bugs (e.g. users.py:232). Fix + flip to error.
• unresolved-attribute (138) is mostly ONE root cause: the YetiTagModel/YetiContextModel/YetiAclModel mixins call self.save()/self.neighbors()/self.extended_id, which only exist once combined with ArangoYetiConnector. Fixable at the root with a TYPE_CHECKING protocol on YetiBaseModel — clears a large chunk cleanly.
• unresolved-import (3): boto3/tldextract/yara (env-dependent) — add to the typecheck env or allowlist.
• invalid-parameter-default (15): the arg: list = None → Optional[...] cleanup.
• Widen src.include to plugins/, yetictl/ once core/ is clean.