feat(ci): per-file type-checking in pre-commit/editor LSP (tsc --noEmit, ty check) (CA-14)

[krokoko]

This is a finding from https://github.com/krokoko/cairn (action item CA-14).

Component

Tooling / CI

Describe the feature

Add per-file type-checking to pre-commit / editor LSP so type errors surface at Tier 1 (per-file, on save/commit) instead of Tier 3 (the full CI build):

• TypeScript: tsc --noEmit
• Python: ty check (already available as a task)

Use case

Type checking today runs primarily at CI time (T3), with only partial T1 coverage via the eslint hooks. That is the slowest, latest place to catch a type error — an agent or developer gets the signal only after a full build round-trip. Shifting type checking left to per-file (T1) tightens the inner loop and catches plausible-fabrication (AI001) calls to non-existent APIs at the moment they're written, before they reach the PR gate.

Proposed solution

1. Add a tsc --noEmit pre-commit hook (prek) for changed TS files, scoped per package (cdk, cli).
2. Add a ty check pre-commit hook for changed Python files in agent/.
3. Document the recommended editor LSP setup so the same checks run live in-editor.
4. Keep the full CI type check as the authoritative gate (shift-left adds a fast loop, doesn't replace the gate).

Acceptance criteria

• A per-file tsc --noEmit pre-commit hook runs on changed TS files.
• A ty check pre-commit hook runs on changed Python files.
• Editor LSP setup for both is documented (developer guide / CONTRIBUTING).
• The full CI type check remains the authoritative gate; hooks are additive and fast.

Other information

Source report: verification-strategy.md (Shift-Left Recommendations — type checking T3→T1). Effort: S. Note: prek hooks are client-side and bypassable with --no-verify; the CI build check remains the authority. Per ADR-003 this issue needs the approved label before work begins.