Tracking: complete the `ty` gradual-typing baseline (un-ignore rules; PEP 723 blocker astral-sh/ty#691)

Summary

Follow-up to #15180, which added an informational ty type-check job (.github/workflows/ty.yml, continue-on-error: true, ty check --exit-zero). This issue tracks what it takes to turn that advisory job into a required gate as type hints are added to the algorithms gradually, and records the current blockers.

How the gradual baseline works today

pyproject.toml [tool.ty] pins the interpreter and currently ignores 15 rules so the informational job starts from a green-ish baseline instead of drowning in noise:

call-non-callable, deprecated, invalid-argument-type, invalid-assignment,
invalid-parameter-default, invalid-return-type, invalid-type-arguments,
invalid-type-form, no-matching-overload, not-iterable, not-subscriptable,
parameter-already-assigned, unresolved-attribute, unresolved-import,
unsupported-operator

Requirements to "complete" the work

The work is done rule-by-rule, matching how typing is added to the algorithms incrementally:

1. Pick one ignored rule from the list above.
2. Fix the files that trip it — add annotations / correct signatures — as bite-sized good-first-issues. unresolved-import is largely environment noise (third-party stubs) and should be handled by making sure uv sync installs the dep, not by editing code.
3. Un-ignore the rule: delete its rules.<name> = "ignore" line in [tool.ty] once its diagnostic count is zero on a synced 3.14 env.
4. When all rules are un-ignored and the baseline is clean, follow the promotion path documented inline in ty.yml: --exit-zero → --exit-zero-on-warning → drop the flag + set continue-on-error: false to make ty a required check.

Blocker: PEP 723 single-file scripts (astral-sh/ty#691)

ty treats a # /// script inline-metadata file as its own project, so it does not inherit the repo's [tool.ty] rule severities. Those files therefore surface the "ignored" diagnostics regardless of config, which will produce false failures the moment any rule is promoted to error. Until astral-sh/ty#691 lands, the options are:

• run the gate with ty check --exclude-scripts (skips PEP 723 files), or
• keep the job informational for script files specifically.

Un-ignoring rules for the non-script bulk of the repo can proceed in parallel and does not need to wait on #691.

Note on ty check --fix

For the record (asked on #15180): on the current tree, ty check --fix reports 0 fixed, 36 remaining — i.e. no changes, as expected. ty 0.0.74 ships no autofixes for any of these diagnostic categories yet, and it has no --unsafe-changes flag (the safe/unsafe fix split is a ruff feature ty hasn't implemented). So there is nothing for a "--fix results" PR to contain right now; this is worth revisiting once ty grows fix support.