[C1] No ruff/mypy lint or type gate in any CI workflow **[#1 process gap]**

[DsThakurRawat]

Labels: ci, tooling, priority:high
File: .github/workflows/* (none run ruff/mypy); .pre-commit-config.yaml (pre-commit-only)

Description. grep -rniE "ruff|mypy|lint|typecheck" .github/workflows/ returns nothing across all 8 workflows. Ruff + mypy exist only in pre-commit, bypassable with git commit --no-verify and never run for contributors who don't pre-commit install.

Why it matters. A PR with lint or type errors merges green. This is exactly how PR #259's indentation drift reached green CI. Type regressions ship because mypy never runs on PRs.

Tasks.

• Add a lint job (new lint.yml or a job in pytest.yml) running ruff check ., ruff format --check ., and mypy --config-file=pyproject.toml src/ on push + PR to main.
• Note: ruff format --check will initially fail on pre-existing drift in cli.py (~lines 136–161) — land a format-only commit first.

Dedup. #59 adds bandit only (security scanner), not ruff/mypy/format. Distinct and broader.