fix: add a mypy gate for jq_collector and fix what it found (#38)

[tschm]

Fixes #38

Acceptance criterion (verbatim):

CI fails on a type error in jq_collector, and the current tree passes.

What changed

The gate

• collector/pyproject.toml: mypy and types-PyYAML added to the dev group (uv.lock relocked), and a [tool.mypy] table with files = ["jq_collector"] and python_version = "3.11" (the requires-python floor). Default strictness, not --strict, per the issue's "start non-strict".
• .github/workflows/ci.yml: a Types step, uv run --frozen mypy, in the collector (lint + tests) job. It passes no flags; scope comes from the config.

The 12 errors mypy found on main, fixed with annotations and no # type: ignore:

Site	Fix
github.py / gitlab.py: **params: object → httpx params (2 errors)	**params: str | int on all 7 helpers; every call site passes a str or an int
localgit.py: **dict[str, object] into LocalRepo (4)	_measurements returns a _Measured TypedDict naming exactly the fields it fills
metrics.py: object assigned to WorkflowRun (1)	unique: dict[str, WorkflowRun]
__main__.py: invariant dict passed to collect (2)	coverage_cache annotated with the type collect declares
github.py latest_runs: object has no .get (3)	isinstance(…, dict) narrowing, as every other _json call site in the file already does; keys typed Any (they're JSON values)

One behaviour change, deliberately: in latest_runs, a response that parses as JSON but isn't an object (e.g. a list) used to raise AttributeError and error the whole repo for that refresh. It's now treated like a missing feed. That matches how the other twenty-odd _json call sites in github.py/gitlab.py treat a malformed response. Nothing else changes at runtime.

Checks (run locally from collector/, as CI does)

• uv run --frozen ruff check jq_collector tests: pass
• uv run --frozen ruff format --check jq_collector tests: pass
• uv run --frozen mypy: Success: no issues found in 11 source files
• tests on 3.12: 447 passed, 100.00% coverage (floor met)
• tests on 3.11: 447 passed, 100.00%
• Negative check: in a scratch copy with def _broken() -> int: return "not an int" added to forge.py, uv run --frozen mypy exits 1 and reports the return-value error. So a type error fails the step.

Not addressed

• --strict (or disallow_untyped_defs) is left for later. For example, metrics.render still has no return annotation.
• tests/ isn't type-checked; the config scopes mypy to the package.

Closes #38

🤖 Generated with Claude Code