Dogfood pyrefly typecheck on forge: strict pyrefly.toml + triage type findings

[misnaej]

Follow-up to #55 (opt-in typecheck step, pyrefly). While dogfooding pyrefly on forge's source we learned two things:

1. pyrefly's default basic preset is too weak to be useful

On basic it reported only 12 false positives (interrogate's attrs-generated InterrogateConfig.__init__) and missed a real bug (the tokenize.TokenizeError AttributeError, fixed separately). Enabling typecheck on forge needs a strict pyrefly.toml (untyped-def-behavior = "check-and-infer-return-type"), not the default.

2. Strict run surfaced real findings to triage

Excluding the 12 interrogate false positives, strict pyrefly reports (need individual verification — some may be guarded/false):

• DocstringVerifier passes str | None where str expected ×3 (Optional not narrowed)
• CheckResult(detail=str | None) where str expected
• a -> bool function can return list[stmt]
• _bad_scan_paths(paths) receives object from cfg.get("paths") (precommit.py — new in feat(precommit): pluggable step framework + doctest/typecheck/doc-consistency steps #55; dynamic-config typing gap)
• ast.get_docstring(AST) / jsonschema iter_errors arg types (may be stub-driven)

3. interrogate false positives need silencing

pyrefly can't see attrs-generated __init__ kwargs. A pyrefly.toml should ignore unexpected-keyword for the interrogate import (or treat interrogate as untyped) so the 12 FPs don't drown real signal.

Scope when picked up

• Add a strict pyrefly.toml
• Silence the interrogate FPs
• Triage + fix the real findings above
• dev/setup.sh → install [dev] (so forge's env has pyrefly) — may already land via feat(precommit): pluggable step framework + doctest/typecheck/doc-consistency steps #55
• Enable [tool.forge.precommit] enable = ["typecheck"] on forge, non-blocking
• Update docs/release-process-style notes if the gate becomes blocking later

Requires: #55 to merge first.

[misnaej]

Delivered by #60 (v1.24.1): strict pyrefly.toml, all 15 real findings fixed, interrogate FPs silenced, typecheck enabled non-blocking on forge, + forge-doctor checks enabled-step tools. [issue-triage] closing as shipped.