chore: ruff + mypy strict + import-linter + commitizen config

[constk]

Problem

Without lint, type-check, architecture, and commit-message contracts in place from day one, any code added to the repo immediately accumulates inconsistencies that LLM coders will reproduce.

Proposed solution

Port the four config blocks from Teller's pyproject.toml verbatim: [tool.ruff] (E W F I N UP B SIM TCH S RUF with pep8-naming + bandit + flake8-simplify + tch), [tool.mypy] (strict = true, disallow_untyped_defs, warn_return_any, check_untyped_defs), [tool.importlinter] (layers + models-forbidden contracts; layer set pared to api -> eval -> agent -> tools -> data -> observability -> models per scaffold). [tool.commitizen] with the 7-prefix schema (feat/fix/docs/test/refactor/chore/release).

Acceptance criteria

• ruff check . and ruff format --check . pass on the empty scaffold.
• mypy --strict src/ tests/ passes on the empty scaffold.
• lint-imports passes (contracts may reference empty modules at this stage).
• Per-file ignores ported (TCH003 in models/, S101+TCH001 in tests+eval/, S603+S607 in hooks/).
• Commitizen schema rejects unknown commit-type prefixes locally.

Priority rationale

Critical: these are the static gates that every subsequent feature ticket leans on; landing them now means later tickets fail fast on contract drift instead of accreting violations silently.

Depends on

#1

[constk]

Auto-close did not fire from the squash-merge body. Marking closed retrospectively — the work shipped weeks ago and the project board's Done column reflects the actual state once the project-item move that follows this comment lands.