Integrate Astral's `ty` type checker into `make lint`. Browser-tests are
excluded (separate venv/Docker deps). Fix errors with real code fixes where
possible, falling back to `# type: ignore` only for third-party stub gaps.

Real fixes:
- `make_lfs_pointer`: correct return type `pygit2.Oid -> bytes`
- `remote.fetch(prune=True)` -> `FetchPrune.PRUNE` enum
- `reset_repo`: accept `RemoteCallbacks | None`
- `push_mirror`: accept `Iterable[str]` instead of `list[str]`
- `to_upload` list: fix dest tuple type (2-elem -> 3-elem)
- `git_export`: fix `set[str]` return types, `list()` cast, `import urllib.parse`
- `build_bundles`: `write_zip` accepts `str | bytes`; rename shadowed `to_delete`
- `git-reader/app.py`: fix `hello()` return type `str -> dict`
- `git-reader/tests`: use `ObjectType.COMMIT` instead of int constant
- `signer/utils.py`: `Any` import, `logger.warning`, `old is not None` guard
- `signer/support.py`: remove Python 2 ConfigParser compat
- `test_generate_keypair/test_signer`: `mkstemp` instead of deprecated `mktemp`
- `refresh_signature`: `datetime.fromtimestamp(tz=)` instead of deprecated `utcfromtimestamp`
- Add explicit `import ecdsa.util`, `import requests.adapters`, `import unittest.mock`

Type-ignore suppressions (third-party stub gaps):
- `responses` library: `request.url`, `request.body`, `request.headers`, `request.method`
- `kinto_http.AsyncClient`: awaitable stubs
- `canonicaljson`, `dockerflow.checks`, prometheus metrics
- `colander.SchemaNode` metaclass, test mixin `super().setUp()` patterns

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>