ci: cover consumer fixtures in style and strict typing gates

[codeforester]

Fixes #393

Extend formatting, lint, and strict typing checks to the compatibility consumers and example applications. Discover Python sources so future consumer directories remain covered.

Branch maintenance

Refs #426. Targets main.

The branch was refreshed without rewriting history to include main at a576cc279739eae5e4cfc33ffab2a7fb56de24de. The already-merged calibration patch is absent from this review diff; the original issue patch is preserved.

Current-head validation

At 857e52e8ecc9058edd2a7a820f7b00175f41219a: uv lock freshness and baseline, runtime, strict typing, style, and contracts passed locally with all declared extras. Runtime result: 608 passed, 1 warning, 262 subtests passed in 9.23s.

Hosted checks: 7/7 required checks passed; 0 checks pending; 0 unsuccessful checks at 2026-10-04T14:19:40.760978+00:00. See the PR Checks tab and #426 for subsequent results.

[codeforester]

Additional finding (unchanged file outside this diff, so not postable as an inline comment):

pyproject.toml's [tool.ruff] table has no exclude key at all. The whole-repo ruff check . / ruff format --check --exclude "*.md" . scoping this PR relies on therefore depends entirely on Ruff's hardcoded default directory excludes plus .gitignore (respect-gitignore=true by default). .gitignore doesn't list .mypy_cache/, .ruff_cache/, or .hypothesis/ — all three can exist as untracked dirs in a local checkout. Currently harmless: Ruff's built-in defaults already hard-exclude .mypy_cache/.ruff_cache regardless of gitignore, and none of the three currently contain .py files that git ls-files would pick up for the mypy script either. But there's no project-level backstop — if that ever changes, both gates would silently start scanning a cache directory with nothing in the repo config to stop them. Low priority; worth a one-line exclude addition for defense-in-depth.

[codeforester]

Reviewed against #393's acceptance criteria. Ruff now runs repo-wide, consumer packages are under strict mypy, and Git-based discovery means a new top-level directory can't slip past the gate. That covers all four criteria. CI is green (112 pass / 5 skipped).

Merge blocker: the branch is BEHIND main, and the default-branch ruleset requires branches to be up to date. #415 through #423 are stacked on this branch, so updating it here will ripple through the whole stack.

Two non-blocking notes are inline.