ci: expand host-verify with lint, typecheck, security, depscan and coverage gates

Phase 1 of audit-hardening CI expansion (baseline origin/main aebc623):
- lint: ruff E9 hard gate; full E,F@120 report-only (baseline 111 items)
- typecheck: mypy default mode, production scope, report-only (baseline 24)
- security: bandit production scope, report-only (baseline 287, High 5)
- depscan: pip-audit on requirements-ci.txt, hard gate (0 vulns; repo has
  no production dependency manifest, see summary)
- coverage: production 58 files, fail-under=75 (baseline measured 76%)
- release build: E9 + pip-audit hard gates before packaging; full reports
  stay in host-verify to avoid drift
No production code changed; CI billing failure mode unchanged.

mypy.ini

@@ -0,0 +1,12 @@
+# Mypy 配置：默认（非 strict）模式。
+# 代码库基本无类型注解，strict / disallow-untyped-defs 在基线下会
+# 淹没真实错误，故第一阶段只用默认模式 + 缺失第三方导入忽略。
+# ignore_missing_imports：psycopg 等驱动是宿主侧延迟加载，CI 环境
+# 不保证安装，缺导入不应算类型错误。
+# exclude：测试目录与 work/ 不进类型检查。测试大量用动态 mock /
+# 模块遮蔽（如 test_queue_sandbox 的 queue 遮蔽），属于测试脚手架
+#  artifact，不是生产类型错误；生产范围另见 workflow 的 mypy 命令。
+[mypy]
+ignore_missing_imports = True
+show_error_codes = True
+exclude = (?x)(^|/)(tests|work)/|test_[^/]*\.py$