audit fixes: checked types + curated lint; install-mcp drift guard; strict policy keys; transport credential guard

[inth3shadows]

Three fixes from the 2026-07-14 module-by-module audit, approved as a batch.

1. Annotations → checked contract

• [tool.ruff.lint] curated select (I,B,UP,C4,SIM,RET,PLE on top of defaults) — the repo previously ran ruff's minimal defaults with no config at all.
• [tool.mypy] lenient baseline (ratchet later), added to the CI lint job; mypy in dev deps.
• Burn-down: 114 ruff findings (96 auto-fixed; 18 manual with explicit zip(..., strict=) chosen per real semantics at each site). 17 mypy errors, several genuinely load-bearing:
  • pump() claimed src: TextIO but receives an Iterator[str] from HttpTransport → now Iterable[str] (the actual contract);
  • answer_retrieve could index the drop store with a non-str handle from a malformed call → explicit miss;
  • an invalid # type: ignore comment in _emit_audit (trailing prose broke the syntax) was suppressing nothing → replaced with real narrowing.

2. install-mcp drift guard

A re-wrap rebuilt the entry purely from the stashed original, silently reverting hand-edits to the wrapped entry — this reverted codegraph's node@22 env.PATH pin in production on 07-13. wrap() now carries live non-terse-owned keys forward (command/args always rebuilt; url/headers never resurrected from a drifted entry), do_install reports the preserved keys, the CLI prints them with the uninstall caveat, USAGE updated. Regression test reproduces the codegraph scenario exactly.

3. Hardening pair

• load_policy rejects unknown keys at every level (_-prefixed annotations exempt — the policy_gen convention). It immediately caught a latent specimen in our own tree: a multiproxy test's policy file used "rules" (schema says "policies") and the old loader swallowed it.
• HttpTransport refuses credential-bearing headers over cleartext http to a remote host — parity with fluency.openai_answerer's existing TLS guard. Loopback gateways and https unaffected.

Verification

• 476 tests pass (+5), ruff clean at the new bar, mypy clean.
• The live production policy file loads under the strict loader (verified against a real proxy launch) — no deployment impact.