fix(ci): make quality-gate verify pass end-to-end

[yuzushi-dev]

Root cause

verify (the quality-gate workflow → scripts/verify.sh all) was red on main, so it failed identically on all 5 open PRs. verify.sh runs under set -e and ruff is the first check, so CI aborted at ruff and every PR surfaced the same error. Running the entire gate locally against a clean origin/main worktree revealed main was actually broken at three independent steps — the later ones were simply never reached in CI:

step	status on origin/main	detail
ruff	❌ 33 errors	unused/unsorted imports, redefinitions, 2 unused locals, 1 mutable default arg, 1 unnecessary comprehension, 1 pyupgrade
import-linter	✅
mypy	❌ 16 errors	all in src/cli/* + sufficiency.py (not in the override list)
pytest (unit)	✅
eslint	❌ 2 errors	react-hooks/set-state-in-effect in DocumentLibrary.tsx
frontend build / test	✅

Underlying reason: main was pushed while its own gate was failing, compounded by unpinned tooling — ruff>=0.1.0, mypy>=1.8.0, and eslint-plugin-react-hooks@^7.0.1 pulled newer, stricter releases than the code was written against.

What this PR fixes

ruff (33): ruff --fix for the safe fixes + manual edits, all behavior-preserving. Removed a dead is_primary block in the failover chat() method (never read there, unlike its two sibling methods) and a dead total count in the chat-history admin route. unit_of_work mutable default group_ids=[] → None (ctor already normalized via list(...)).

mypy (16) — real bugs fixed, no override-list additions:

• eval.py / tui.py: typer.Exit("string") passed a str where an int exit code is expected → typer.echo(msg, err=True); raise typer.Exit(1) (preserves the stderr message + non-zero exit).
• tui/app.py: Widget has no .press() → query_one(id, Button) uses the real Button API (textual 8.x).
• remaining no-any-return / arg-type / unused-ignore / missing annotations / sufficiency.py **kwargs splat → resolved with casts, precise annotations, and kwargs: dict[str, Any].
• _session.session_scope is intentionally annotated to yield a loosely-typed session (documented in its docstring): the CLI operates over legacy Column-style ORM models, and a precise AsyncSession type would un-mask ~19 pre-existing SQLAlchemy stub assignment errors across the CLI that are out of scope for this gate fix (the same debt the rest of the repo handles via the mypy override list). This keeps behavior and the CI error surface unchanged.

eslint (2): both flagged setState-in-effect calls are intentional state syncs (reset pagination on filter change; prune selection against the current document set — the functional update is a no-op when nothing changed, so it cannot loop). Suppressed with targeted // eslint-disable-next-line react-hooks/set-state-in-effect + explanatory comments. No refactor.

Tooling pinned to the currently-resolved versions to prevent recurrence: ruff==0.15.14, mypy==2.1.0, eslint-plugin-react-hooks 7.0.1 (exact; lockfile re-synced).

Verification

Ran the full gate in a clean worktree checked out from origin/main:

ruff           ✅ All checks passed!
import-linter  ✅ Contracts: 5 kept, 0 broken
mypy           ✅ Success: no issues found in 325 source files
pytest (unit)  ✅ pass (1 skip: kreuzberg not installed)
eslint         ✅ 0 errors (10 pre-existing warnings, non-blocking)
frontend build ✅
frontend test  ✅ 18 passed

Once merged, the 5 open PRs should go green after a rebase/merge from main.