Add type annotations and improve type checking throughout codebase

[seanwevans]

This PR improves type safety and mypy compliance across the codebase by adding explicit type annotations, fixing type inconsistencies, and adding type ignore comments where necessary.

Key Changes

Type Annotations:

• Added explicit type annotations to function parameters and return types in runtime/thread.py, policy/model.py, policy/__init__.py, __init__.py, observability/alerts.py, operator/__init__.py, supervisor.py, watchdog.py, broker/crypto.py, and broker/uring.py
• Declared class attributes in SandboxThread to document the class contract (_backend: str, _temp_dir: Path)
• Added type hints for instance variables in _reset_runtime_state() and other initialization methods

Type Consistency Fixes:

• Changed Decision type imports and parameter types in _deny() function to use the proper Decision type instead of string literals
• Updated socket method signatures to use Any instead of Iterable[str] for address parameters to match actual socket API
• Changed return type of _module_proxy() from types.ModuleType to Any for better type compatibility
• Updated _require_clock() return type to ClockCapability | None to reflect actual behavior
• Fixed on_violation callback type to return object instead of None

Variable Naming Improvements:

• Renamed loop variables from generic rule to more specific names (tcp_rule, net_rule, str_lst) to avoid shadowing and improve clarity in policy/model.py and policy/__init__.py

Type Ignore Comments:

• Added # type: ignore[assignment] for socket.sendto guard with explanatory comment about signature collapsing
• Added # type: ignore[misc] for SandboxedPath class definition
• Added # type: ignore[assignment] for YAML module assignment

Bug Fixes and Improvements:

• Fixed condition in _merge_allowed_imports() to check allowed_imports is not None instead of just the variable name
• Fixed _is_native_origin() to properly check for None before calling string methods
• Added runtime type check in watchdog.py to ensure name is a string before using it
• Fixed test flakiness in test_crypto.py by adding retry logic with deadline for concurrent frame delivery
• Updated conformance.py to use threading.get_native_id() instead of os.gettid() for better portability
• Updated .pre-commit-config.yaml to add types-PyYAML dependency and use python -m pytest for better hook reliability

Import Improvements:

• Added from collections.abc import Iterable, Mapping and Iterator imports where needed
• Added TYPE_CHECKING imports for forward references in operator/__init__.py and supervisor.py
• Added cast import in supervisor.py for type casting

These changes improve code maintainability, enable better IDE support, and catch potential type-related bugs earlier in development.

https://claude.ai/code/session_01DDSofWX5HwawsrwbN2nSXR