ci: add bounded Forge mypy gate

[im-sham]

Summary

• Locks mypy 1.19.1 and PyYAML stubs in the existing reproducible development dependency surface.
• Adds a practical blocking mypy policy for exactly forge_cli/models.py and forge_cli/incident_store.py.
• Records 14 normalized repository diagnostics in a versioned JSON baseline and prevents stale, replaced, inflated, or count-growing debt against the trusted base.
• Uses structured file/code/message keys so harmless line movement does not create false growth.
• Adds the gate inside the existing test matrix, preserving all twelve required status contexts.
• Applies behavior-preserving annotations and variable renaming for the five pre-existing incident_store diagnostics.

Verification

• Full test suite: 405 passed.
• Focused type-gate suite: 28 passed.
• Incident-store suite: 104 passed.
• Python 3.11, 3.12, and 3.13: 0 critical diagnostics and the same 14 normalized repository diagnostics.
• Deliberate wrong-return mutation: rejected by the actual gate, then restored.
• Ruff, compileall, exact lock verification, and git diff --check: passed.
• Two independent Sol-high reviews: PASS with no actionable findings.
• Hosted CI: all twelve required status contexts succeeded.
• Unresolved review threads: 0.
• Reviewed base: 47c152e.
• Exact head: 13825e8.

Boundaries

This remains a draft, bounded Forge tranche. It does not claim WP-MA-03 or G5 completion and does not authorize deployment, production, traffic, credentials, protection changes, customer or partner activity, external claims, or any other PR merge.

Forge PR #19 remains a separate contract-typing change. It was not modified or absorbed and should rebase onto this gate after this tranche is resolved.