fix(foundation): reconcile full-profile typing and runtime guards

[szmyty]

Follow up #82 and the golden-root adoption in #88. Parent: egohygiene/.github#32. Roadmap-Step: EMP-Q04.

The merged gitignore behavior tests pass, but the completed full-profile MegaLinter run reports typing/import-resolution and runtime-assertion findings in the foundation tooling and test harness. The fast PR profile does not exercise those checks.

Verified source: main 87d1d5b85ee06b7c98fcccc33b031092c2afa252, including report-only refreshes after #88. No matching open follow-up or competing PR was present.

Scope:

• Correct type narrowing and module resolution in tools/foundation.py, its composition module, and the foundation/gitignore tests.
• Replace assertion-only production guards with explicit error handling.
• Preserve the accepted foundation version, composition behavior, source hashes, active root, and deterministic generated outputs.
• Add focused behavioral coverage where input/error behavior changes.
• Validate the foundation components with the actual full-profile mypy/Bandit/Ruff configurations and pinned report versions, plus the repository tests.
• Record completed PR checks, residual repository-wide findings, and the next bounded action in the iteration checkpoint and master epic.

Acceptance:

• Foundation tooling and tests pass scoped strict mypy without disabling checks or suppressing the findings.
• Foundation production code passes the configured Bandit checks with runtime guards retained under Python optimization.
• Existing foundation/composition/adoption behavior and deterministic outputs remain intact.
• Meaningful regressions cover any changed rejection/error behavior.
• CI and remaining debt are reported accurately, and the handoff is ready for maintainer review.

This issue does not own the imported EgoLint release-pin/bootstrap fixes, inherited nested-ignore policies, repository-wide vulnerability remediation, Cargo wiring, reusable conformance, or Filament adoption. Those remain explicit follow-ups in the epic. Preserve #82's closure.

Work one bounded PR through review; the maintainer merges.

Merged checkpoint

• Accepted PR: #90 merged on 2026-09-18 at 14:13 UTC as b44f798bb49259f9f48416b4ffebde1103e135c0. Verified main and its tree exactly match the tested proposal tree from head 87d09583edfad13156d124f262ff7563f23ad736; no additional review decisions or competing Empathy PRs were present. Issue fix(foundation): reconcile full-profile typing and runtime guards #89 is closed.
• Implementation: explicit static source imports, typed helpers/fixtures and validated-value narrowing, production failure results instead of assertions, and diagnostics for malformed override IDs/non-object JSON. Two new behavior tests include eight real normal/optimized CLI rejection cases with output preservation.
• Scoped validation: mypy 1.19.1 passes all six foundation/tool/test files (baseline: 128 errors in four files). Bandit 1.9.4 passes production code and all four foundation/gitignore test modules (baseline: three production assertion findings). CI-configured Ruff 0.16.5, Prettier 3.8.1, Markdownlint 0.48.0, and staged diff checks pass.
• Behavior and projections: 117 root tests run, 115 passed, two expected Identity skips. Existing composition/adoption tests confirm the same root rules and deterministic inventory/projection/plan. Foundation stays 1.1.0; canonical and generated contracts are unchanged.
• Project-wide typing: configured discovery checks 48 files and still reports 36 errors in tools/task_catalog.py, tools/staging_removal_gate.py, tests/test_staging_home_audit.py, and tests/test_staging_removal_gate.py. No errors remain in the six foundation components. This is not whole-repository conformance.
• Completed PR CI: All six workflows completed. MegaLinter fast profile, CodeQL, dependency review, and commit validation passed. Automation confirms the 117-test root suite with two expected skips, then fails only the existing EgoLint catalog/workflow pin mismatch (31 tests, one failure). OSV fails its existing severity gate with 84 findings at or above high severity. MegaLinter's existing pre-command syntax diagnostic persists. Mypy/Bandit were verified locally with the full-profile configuration; fast PR CI does not run those tools. No all-green repository claim.
• Resume record: part 4 checkpoint. Architectural ownership and roadmap completion remain unchanged.
• Next proposed part: one Empathy CI-integration PR to reconcile the workflow/catalog MegaLinter revision and repair the optional JSON-plugin bootstrap shell command. Add focused consistency/execution tests and verify the existing EgoLint suite and completed CI. Canonical EgoLint still declares v10.0.0 and does not contain Empathy's optional-plugin bootstrap; its broader policy graduation feat(assurance): establish enterprise security, privacy, and compliance baseline #51 is separate. Reconcile inherited ignore-policy exceptions afterward, with wider validation/vulnerability debt explicitly tracked before the pinned Filament pilot. No next implementation has started.
• Stage: merged and complete for fix(foundation): reconcile full-profile typing and runtime guards #89's bounded foundation cleanup. Preserve 🧹 Define a conservative layered .gitignore baseline and profile ownership #82/fix(foundation): reconcile full-profile typing and runtime guards #89 closure; remaining CI/content and broader validation work stays in the master epic.

Refreshed 2026-09-18 after verifying #90's merge.