Enforce annotation coverage going forward (ruff ANN rules)

[tschm]

Problem

mypy currently passes clean on all 21 source files, but annotations are not enforced on new code — ruff's `ANN` rule family is not selected. Nothing prevents new untyped functions from landing (there is already one untyped-function note in `language_validators.py:152`).

Proposal

• Enable ruff `ANN` rules (at least `ANN001`, `ANN201`/`ANN2xx`) to lock in the now-clean type coverage.
• Optionally add `--check-untyped-defs` to the mypy config.
• Triage/ignore any existing gaps explicitly so the gate stays green.

Context

Surfaced in repository analysis (2026-06-14). Type safety scored 9/10; this closes the remaining gap.

[tschm]

ℹ️ Blocked on upstream — ruff.toml is a Rhiza-managed file.

ruff.toml is owned by the upstream template repo jebel-quant/rhiza and is listed in .rhiza/template.lock. Any local edit here is overwritten on the next make sync (see CLAUDE.md → "Rhiza-managed files — do NOT edit directly").

To land the ruff ANN rule selection:

1. Make it upstream in jebel-quant/rhiza (the bundle source that ships ruff.toml).
2. Cut a new Rhiza release.
3. Bump ref: in .rhiza/template.yml here and run make sync.

Note: --check-untyped-defs lives in the [tool.mypy] block of pyproject.toml (locally owned), so that part could be done here; the ruff ANN part must go upstream. Deliberately excluded from #535 for this reason.

[tschm]

Filed upstream as Jebel-Quant/rhiza#1200 — the ruff ANN rule change must land there (it ships ruff.toml) and reach this repo via a new release + make sync. The --check-untyped-defs mypy half can still be done here.