Backend tooling: add a fail-closed ty type-checking gate

[Konan69]

Context

The backend currently has no configured ty, mypy, or Pyright CI gate. Tests contain runtime shape assertions and targeted static-analysis suppressions, but introducing a type checker was intentionally kept outside PR #180.

Outcome

Add a fail-closed backend static type-checking contract before considering removal of any runtime tests that only duplicate proven type invariants.

Scope

• Select and pin ty as a development/CI dependency in a separate reviewed change.
• Define explicit source scope, Python version, exclusion policy, and suppression policy.
• Establish a clean baseline without weakening test or coverage gates.
• Produce an invariant map linking candidate runtime shape tests to static checks.
• Remove or consolidate a runtime test only when equivalent static proof is documented and behavior coverage is unchanged.

Acceptance criteria

• ty configuration and dependency are reproducible locally and in CI.
• The gate is fail-closed and runs independently of pytest.
• Baseline diagnostics are either fixed or narrowly documented; no blanket ignores.
• Generated files, migrations, tests, and application modules have explicit inclusion rules.
• No production behavior changes are bundled with tool adoption.
• No coverage floor is lowered.
• Any deleted runtime test has an evidence table proving exact redundancy.
• CI timing before and after the new gate is recorded.

Non-goals

• Replacing PostgreSQL integration tests.
• Replacing migration, trigger, lock, transaction, or concurrency proofs.
• Broad application refactoring merely to satisfy the checker.