chore: resolve ty type checker diagnostics (41 errors)

Summary

After adding ty (v0.0.23) as a type checker, the codebase has 41 diagnostics that need to be resolved before typecheck can become a blocking CI check and pre-commit hook.

Currently, typecheck is advisory (non-blocking) in both the Makefile (- prefix) and pre-commit (|| true).

Diagnostic categories

Source code (~14 errors)

• custom_columns.py (7 errors) -- Passing list[dict] from .as_dict() calls where list[EntitySchema] is expected. Pydantic accepts dicts at runtime, but ty's static analysis doesn't know that. Fix: pass model instances directly, or add # ty: ignore comments.
• postprocess.py (5 errors) -- dict.get() overload resolution failures on dicts with inferred narrow key types after isinstance guards.

Test code (~20+ errors)

• Tests passing raw dicts where Pydantic model instances are expected (same pattern as source)
• AnonymizerConfig(detect={...}) -- passing dict instead of Detect model
• test_debug_logging.py -- tmp_path fixture typed as TempPathFactory instead of Path
• tempfile.mktemp deprecation warning

Excluded (already handled)

• tools/ is excluded via [tool.ty.src] exclude = ["tools/"] since those scripts use PEP 723 inline deps not in the venv.

Definition of done

• All 41 diagnostics resolved (fix or suppress with targeted # ty: ignore[rule-name])
• Remove || true from typecheck pre-commit hook
• Remove - prefix from Makefile typecheck target
• Typecheck CI job made blocking (remove continue-on-error if set)

References

• PR #51 introduced ty and the advisory typecheck infrastructure

Start by running the advisory ty typecheck and group the 41 diagnostics across custom_columns.py, postprocess.py, the test files, Makefile, pre-commit hook, and CI configuration. Resolve or narrowly suppress each reported diagnostic, then make the checks blocking by removing the advisory wrappers and verify that typecheck passes.