ci: 100% enforcement — mypy + format-check + every pre-commit hook

[fede-kamel]

The previous CI ran `ruff lint` + tests across the Python matrix but left mypy, ruff format, gitleaks, doc8, markdownlint, codespell, and the rest of the pre-commit suite unchecked at PR time. Recent runs also failed at `startup_failure` because of a brittle ternary in `ci-success`.

This PR makes CI 100% match the local pre-commit + check pipeline.

Workflow changes

• _lint.yml now runs hatch run check (format-check + ruff + mypy) across Python 3.11 and 3.14.
• _precommit.yml (new) runs pre-commit run --all-files against every hook in .pre-commit-config.yaml: gitleaks, EOL, whitespace, ruff lint, ruff format, doc8, markdownlint, YAML format, large-file guard, etc. Skips mypy (covered in _lint.yml across the matrix) and the manual-only poetry-check.
• ci.yml wires precommit into the orchestrator alongside lint / test / codespell / dco. Replaces the broken complex ternary in ci-success with a simple grep over the needs.*.result JSON blob — that ternary was the source of every recent startup_failure.
• _test.yml unchanged — already runs hatch run test on Python 3.11 / 3.12 / 3.13 / 3.14.

pyproject.toml

• hatch run test is now scoped to tests/unit/ so CI on a fresh runner doesn't try to spin up Oracle / Qdrant / OPENAI fixtures. hatch run test-integration and hatch run test-all still run the broader suites when credentials are available.
• hatch run check is the new combined gate — format-check + lint + typecheck — so contributors and CI run identical checks.
• Lint scope expanded from src tests to src tests examples so pre-commit's ruff (which runs on every .py) and the hatch scripts agree on what's covered. examples/ gets a small per-file-ignore allowance for tutorial-flavour rules.

Validation

• hatch run check clean — format-check + ruff + mypy across 313 files in src/tests + 55 in examples.
• hatch run test — 3193 unit tests pass in 5.2s.
• pre-commit run --all-files --hook-stage pre-commit clean — every hook green.
• All workflow YAML parses cleanly.

What CI now enforces on every PR

Check	Tool	Where
Format	ruff format --check	_lint.yml × 2 Python versions
Lint	ruff check	_lint.yml × 2 Python versions
Type-check	mypy	_lint.yml × 2 Python versions
Unit tests	pytest tests/unit	_test.yml × 4 Python versions (3.11 / 3.12 / 3.13 / 3.14)
Spellcheck	codespell	_codespell.yml
Pre-commit	gitleaks, EOL, whitespace, large-file guard, doc8, markdownlint, YAML format, TOML/JSON/YAML syntax, merge-conflict markers, private-key detection, BOM, mixed-line-ending, ruff lint+format	_precommit.yml
DCO sign-off	tisonkun/actions-dco	ci.yml (PR-only)

Test plan

• CI passes on this PR (the merge gate is ci-success aggregating all jobs).
• Future PRs run all 7 checks above.