feat(ci): per-file type-checking in pre-commit/editor LSP (tsc --noEmit, ty check) (CA-14)

> **This is a finding from https://github.com/krokoko/cairn** (action item **CA-14**).

### Component

Tooling / CI

### Describe the feature

Add **per-file type-checking** to pre-commit / editor LSP so type errors surface at Tier 1 (per-file, on save/commit) instead of Tier 3 (the full CI `build`):

- TypeScript: `tsc --noEmit`
- Python: `ty check` (already available as a task)

### Use case

Type checking today runs primarily at CI time (T3), with only partial T1 coverage via the eslint hooks. That is the slowest, latest place to catch a type error — an agent or developer gets the signal only after a full build round-trip. Shifting type checking left to per-file (T1) tightens the inner loop and catches plausible-fabrication (AI001) calls to non-existent APIs at the moment they're written, before they reach the PR gate.

### Proposed solution

1. Add a `tsc --noEmit` pre-commit hook (prek) for changed TS files, scoped per package (`cdk`, `cli`).
2. Add a `ty check` pre-commit hook for changed Python files in `agent/`.
3. Document the recommended editor LSP setup so the same checks run live in-editor.
4. Keep the full CI type check as the authoritative gate (shift-left adds a fast loop, doesn't replace the gate).

### Acceptance criteria

- [ ] A per-file `tsc --noEmit` pre-commit hook runs on changed TS files.
- [ ] A `ty check` pre-commit hook runs on changed Python files.
- [ ] Editor LSP setup for both is documented (developer guide / CONTRIBUTING).
- [ ] The full CI type check remains the authoritative gate; hooks are additive and fast.

### Other information

Source report: `verification-strategy.md` (Shift-Left Recommendations — type checking T3→T1). Effort: **S**. Note: prek hooks are client-side and bypassable with `--no-verify`; the CI `build` check remains the authority. Per ADR-003 this issue needs the `approved` label before work begins.

Inizia con i task prek esistenti e con la configurazione completa del type-check della build CI per le aree cdk, cli e agent. Esamina verification-strategy.md e la guida per sviluppatori o la documentazione CONTRIBUTING prima di collegare hook aggiuntivi per i file TypeScript e Python modificati. Il lavoro è completato quando entrambi i controlli per file vengono eseguiti rapidamente, esistono indicazioni per l’LSP dell’editor e la build CI rimane autorevole.

Scritto dal modello di indicizzazione a partire dal testo della issue.