fix(foundation): 🔧 resolve typing and preserve runtime guards

[szmyty]

The full-profile scan after #88 finds typing/import-resolution errors and production assertions in the foundation tooling, even though its behavior tests and fast PR lint pass. This PR fixes those foundation findings and two malformed-input paths that previously produced tracebacks.

Closes #89. Follows #82 and #88. Parent: egohygiene/.github#32.
Roadmap-Step: EMP-Q04 (validation evidence; roadmap completion unchanged).

Changes:

• Give static analysis explicit source-module imports while preserving standalone CLI and unittest discovery behavior.
• Add fixture/helper annotations and real type narrowing for validated paths, profile IDs, override IDs, and the Git executable.
• Replace the three production assertions with explicit failure results; remove the obsolete Ruff assertion suppression.
• Return load diagnostics for non-object JSON and validation diagnostics for malformed override IDs.
• Add two regression tests covering invalid override types and eight real CLI cases across normal/python -O execution. Rejected inputs preserve existing output and produce no traceback.
• Update the iteration checkpoint with feat(foundation): 🧹 adopt the composed golden gitignore #88's verified merge, 🧹 Define a conservative layered .gitignore baseline and profile ownership #82's closure, this cleanup, and the remaining work.

The accepted foundation 1.1.0 catalog, schemas, ignore sources, manifest, active root, and generated outputs are unchanged. No lint configuration changes or production finding suppressions are introduced. The test subprocess annotations follow the existing call-specific pattern for test-controlled arguments without a shell.

Validation at head 87d09583edfad13156d124f262ff7563f23ad736:

Check	Result
Strict mypy 1.19.1, actual EgoLint configuration	Pass, all six foundation/tool/test files; baseline reproduced 128 errors across four files.
Bandit 1.9.4, actual EgoLint configuration	Pass, foundation production code and all four foundation/gitignore test modules; baseline had three production assertion findings.
Root repository suite	117 run, 115 passed, two expected Identity skips.
Composition/adoption and generated outputs	Existing root tests pass, including deterministic inventory/projection/plan and exact active-root adoption.
CI-configured Ruff 0.16.5 check/format	Pass on all changed Python files.
Prettier 3.8.1, Markdownlint 0.48.0, staged diff	Pass.
Project-wide mypy with configured discovery	36 remaining errors in four unrelated task/staging files, none in the six foundation components.

Core reproduction commands from the repository root:

python3 -m unittest discover --start-directory tests --verbose
uv tool run --from mypy==1.19.1 mypy \
  --config-file egolint/.config/lint/python/.mypy.ini \
  tools/foundation*.py tests/test_foundation*.py tests/test_gitignore*.py
uv tool run --from bandit==1.9.4 bandit \
  --configfile egolint/.config/lint/python/.bandit.yml \
  tools/foundation*.py tests/test_foundation*.py tests/test_gitignore*.py

All six PR workflows completed at head 87d09583edfad13156d124f262ff7563f23ad736:

Workflow	Completed result
MegaLinter	Passed: fast-profile EditorConfig, Markdownlint, Ruff, and Betterleaks. The existing pre-command shell syntax diagnostic at `
Validate automation	Root suite confirms 117 run, 115 passed, two expected skips. The subsequent 31-test EgoLint suite fails only its existing catalog/workflow release-pin mismatch.
OSV	Existing severity gate fails with 84 findings at or above high severity.
CodeQL	Passed.
Dependency review	Passed.
Commit validation	Passed.

Mypy/Bandit results above are the scoped local full-profile checks; the fast GitHub job does not run them. No all-green repository or full-profile claim.

Remaining boundaries:

This is scoped foundation validation, not a claim that the full repository is green. The existing EgoLint workflow/catalog pin mismatch, MegaLinter pre-command syntax diagnostic, wider full-profile findings, OSV severity gate, imported nested-ignore exceptions, and Cargo fixture wiring remain follow-up work in the epic. Filament adoption follows the remaining acceptance reconciliation. #82 stays closed.

The iteration checkpoint records the next review/merge/sync step. Stop for maintainer review; no self-merge.

• One bounded responsibility; full diff reviewed.
• Foundation-scoped full-profile checks and meaningful behavior regressions pass.
• Accepted generated contracts and ignore behavior preserved.
• Process/checkpoint updated.
• Complete repository-wide validation is green (remaining debt above).

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 15⭐
  Check Your Progress