Remove mypy `ignore_errors` suppression across orchestrator/core modules

[bradjin8]

Problem

cli/pyproject.toml runs mypy in strict = true mode (line 51) but then disables it wholesale for 18 legacy modules via a single [[tool.mypy.overrides]] block with ignore_errors = true (lines 57-78). The baseline note (lines 45-48) records "85 errors in 18 legacy modules suppressed"; only localci.core.config and localci.core.models currently pass strict. Because CI enforces types by running mypy localci/ (.github/workflows/ci.yml:62) and pre-commit runs the same check (.pre-commit-config.yaml:34-36), every suppressed module ships with zero type enforcement — including the orchestration core. This issue scopes the cleanup to the non-CLI modules (orchestrator/core/utils) to keep the diff reviewable and avoid churn/conflicts in the CLI layer, which is left for a follow-up.

Acceptance Criteria

• localci.core.orchestrator is removed from the ignore_errors override list and passes mypy under strict = true
• The remaining in-scope core modules — localci.core.progress, localci.core.queue_builder, localci.core.registry, localci.core.results, localci.core.serialization, localci.core.workflow — are removed from the override list and pass strict mypy
• The in-scope utils modules — localci.utils.docker, localci.utils.resources, localci.utils.yq — are removed from the override list and pass strict mypy (drop the # for localci.utils.resources when it leaves ignore_errors dev-dep comment caveat in pyproject.toml:28 once types-psutil is actually used)
• The 8 localci.cli.* modules remain in the override list (explicitly out of scope) so this PR does not touch CLI typing
• warn_unused_ignores = true (pyproject.toml:54) stays green — no leftover # type: ignore comments that are now redundant
• Tests pass in CI (if applicable)
• PR approved by at least 1 reviewer

Implementation Notes

• The suppression is a single override block in cli/pyproject.toml (lines 57-78). Delete the in-scope module names from the module = [ ... ] list rather than removing the whole block (the CLI modules must stay).
• In-scope (remove suppression, must type-clean): localci.core.orchestrator, localci.core.progress, localci.core.queue_builder, localci.core.registry, localci.core.results, localci.core.serialization, localci.core.workflow, localci.utils.docker, localci.utils.resources, localci.utils.yq.
• Out of scope (leave suppressed): localci.cli.analyze, localci.cli.config, localci.cli.list, localci.cli.logs, localci.cli.run.click_options, localci.cli.run.patcher, localci.cli.run.run_flow, localci.cli.status.
• Start with localci.core.orchestrator — it is the flagship module and its types will surface the true annotations needed on its collaborators (queue_builder, registry, results, workflow), which reduces churn if done first.
• Gotcha: localci.utils.resources needs types-psutil (already declared in the dev extra, pyproject.toml:28) to type-clean; ensure the dev environment installs the [dev] extra before running mypy locally.
• Verify with cd cli && mypy localci/ (the exact CI invocation). Keep strict, warn_redundant_casts, and warn_unused_ignores on.

References

• Eval finding: Test 34 (type-safety) — "Suppressed type errors disable release discipline"
• Related files: cli/pyproject.toml, .github/workflows/ci.yml, .pre-commit-config.yaml, cli/localci/core/orchestrator.py