feat(ci): per-file type-checking in pre-commit/editor LSP (tsc --noEmit, ty check) (CA-14)

> **This is a finding from https://github.com/krokoko/cairn** (action item **CA-14**).

### Component

Tooling / CI

### Describe the feature

Add **per-file type-checking** to pre-commit / editor LSP so type errors surface at Tier 1 (per-file, on save/commit) instead of Tier 3 (the full CI `build`):

- TypeScript: `tsc --noEmit`
- Python: `ty check` (already available as a task)

### Use case

Type checking today runs primarily at CI time (T3), with only partial T1 coverage via the eslint hooks. That is the slowest, latest place to catch a type error — an agent or developer gets the signal only after a full build round-trip. Shifting type checking left to per-file (T1) tightens the inner loop and catches plausible-fabrication (AI001) calls to non-existent APIs at the moment they're written, before they reach the PR gate.

### Proposed solution

1. Add a `tsc --noEmit` pre-commit hook (prek) for changed TS files, scoped per package (`cdk`, `cli`).
2. Add a `ty check` pre-commit hook for changed Python files in `agent/`.
3. Document the recommended editor LSP setup so the same checks run live in-editor.
4. Keep the full CI type check as the authoritative gate (shift-left adds a fast loop, doesn't replace the gate).

### Acceptance criteria

- [ ] A per-file `tsc --noEmit` pre-commit hook runs on changed TS files.
- [ ] A `ty check` pre-commit hook runs on changed Python files.
- [ ] Editor LSP setup for both is documented (developer guide / CONTRIBUTING).
- [ ] The full CI type check remains the authoritative gate; hooks are additive and fast.

### Other information

Source report: `verification-strategy.md` (Shift-Left Recommendations — type checking T3→T1). Effort: **S**. Note: prek hooks are client-side and bypassable with `--no-verify`; the CI `build` check remains the authority. Per ADR-003 this issue needs the `approved` label before work begins.