[CI/CD] Wire mypy into CI as a baseline-gated regression check

[squid-protocol]

🎯 Objective

Add mypy as a required CI check, gated against a committed baseline so it fails only on new type errors -- not the existing 235 (see #429 for the measured breakdown). Same pattern as `tests/dead_key_audit.py`.

🛠️ Implementation

• `tests/mypy_audit.py`: runs `mypy gitgalaxy/ --ignore-missing-imports`, parses output into `{file}:{line}: {code}` keys, diffs against a committed `tests/mypy_audit_baseline.json`.
• Baseline entries no longer reproduced should be reported as FYI (encourage shrinking the baseline in the same PR that fixes them), mirroring `dead_key_audit.py`'s `run_ci_check()`.
• New workflow (or a job in an existing one) running `python tests/mypy_audit.py --ci`.
• Seed the baseline with the current 235 errors so this lands with zero required fixes -- the fixing work is [CI/CD] Wire mypy into CI as a baseline-gated regression check #430/[REFACTOR] Fix root-cause type annotations causing mypy error fan-out #431 (or equivalent numbers once filed).

Known limitation to document

Baseline keys include line numbers, so unrelated edits elsewhere in a file can shift them and produce spurious "new" errors needing a baseline refresh, even when nothing type-relevant changed. This is a standard, accepted tradeoff for line-based mypy baselining (not a bug) -- document it in the script's docstring like dead_key_audit.py's own "SCOPE & LIMITATIONS" section.

Parent: #429

[squid-protocol]

Done and verified in production. `mypy-audit.yml` has been running as a required check on every PR since #434 merged, and has already correctly caught a real environment-dependent baseline mismatch once (#436) -- confirming the gate itself works as designed, not just that it exists.

Closing.