Reach and enforce 100% public type coverage

Summary

Bring Hydra's public API to 100% Pyrefly type coverage and prevent regressions in CI.

Using Pyrefly 1.2.0 with --public-only, the current baseline is:

• 97.32% type coverage
• 725 of 745 typable symbols covered
• 20 untyped symbols
• 81.74% strict coverage (609 typed, 116 resolving to Any)

The remaining non-strict coverage gaps are mostly module-level constants and loggers plus instance attributes such as provider, config_loader, and log.

Acceptance criteria

• Add annotations for the 20 currently untyped public symbols.
• Reach 100% public type coverage for hydra/, excluding generated grammar code.
• Enforce the result in CI with pyrefly coverage check --public-only --fail-under=100.
• Keep strict coverage improvement out of scope; Any-resolved annotations continue to count as covered.