fix(ci): add dedicated lint workflow and fix mypy errors

[aboucaud]

Summary

• New lint.yml workflow: runs ruff check src/ tests/ and mypy src/ on Python 3.13, in parallel with the test matrix, skipped on draft PRs. Linting was previously absent from CI.
• pyproject.toml: split rocrate.* and astra.* into separate mypy overrides — follow_untyped_imports = true only on astra.* (applying it to rocrate.* caused no-untyped-call cascades in wrroc.py); added override for daytona_sdk and dotenv which are eval-only deps not installed in the dev group.
• commands.py: # type: ignore[misc] on astra_init.callback() — Click types callback as Optional[Callable] but it is always set at decoration time.
• eval/build.py: renamed result → dirty to fix CompletedProcess[bytes] assigned to a variable typed as CompletedProcess[str].

Both ruff check src/ tests/ and mypy src/ pass cleanly locally before this PR.

Test plan

• Confirm the new Lint workflow appears and passes on this PR
• Confirm ruff step passes
• Confirm mypy step passes

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	lightcone-cli	68707cc	Commit Preview URL Branch Preview URL	May 13 2026, 11:54 AM

[github-actions]

❌ Eval Results

Metric	Value
Score	0.00
Build complete	❌
Cost	$0.00
Turns	0
Duration	0s
lightcone-cli	0.3.5.dev15+ge5c3625bf (e5c3625b)
Results	Download

Graders

No grader results

Full output

11:53:37 lightcone.eval.build Building lightcone-cli wheel from /home/runner/work/lightcone-cli/lightcone-cli ...
11:53:42 lightcone.eval.build Built lightcone_cli-0.3.5.dev15+ge5c3625bf-py3-none-any.whl (commit e5c3625b)
11:53:44 lightcone.eval.harness Trial build-snae-0 failed: Failed to create sandbox: Invalid credentials
Traceback (most recent call last):
  File "/home/runner/work/lightcone-cli/lightcone-cli/src/lightcone/eval/harness.py", line 112, in run_trial
    sandbox.create()
  File "/home/runner/work/lightcone-cli/lightcone-cli/src/lightcone/eval/sandbox.py", line 149, in create
    self._sandbox = self._daytona.create(
                    ^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/lightcone-cli/lightcone-cli/.venv/lib/python3.12/site-packages/daytona_sdk/_utils/errors.py", line 181, in sync_wrapper
    process_n_raise_exception(e)
  File "/home/runner/work/lightcone-cli/lightcone-cli/.venv/lib/python3.12/site-packages/daytona_sdk/_utils/errors.py", line 139, in process_n_raise_exception
    raise create_daytona_error(
daytona_sdk.common.errors.DaytonaAuthenticationError: Failed to create sandbox: Invalid credentials
  snae trial 0: score=0.00 error: Failed to create sandbox: Invalid credentials

lightcone-cli: 0.3.5.dev15+ge5c3625bf (HEAD e5c3625b)
ASTRA: 0.2.9

  Eval Results: Scores  
┏━━━━━━┳━━━━━━━━━━━━━━━┓
┃ Task ┃     Score     ┃
┡━━━━━━╇━━━━━━━━━━━━━━━┩
│ snae │ 0.00 +/- 0.00 │
│      │  pass@k: 0%   │
│      │   1 errors    │
└──────┴───────────────┘

   Eval Results: Cost &   
         Duration         
┏━━━━━━┳━━━━━━━━━━━━━━━━━┓
┃ Task ┃ Cost / Duration ┃
┡━━━━━━╇━━━━━━━━━━━━━━━━━┩
│ snae │      $0.00      │
│      │       0s        │
└──────┴─────────────────┘

Total: 1 trials, $0.00, 0s

Results saved to: eval-results/build-e5c3625b/results.json

[EiffL]

LGTM

[EiffL]

lol, ok

[github-actions]

Developer Certificate of Origin

This PR has been approved. Before it can be merged, all contributors must sign the Developer Certificate of Origin.

Status

• ✅ @aboucaud
• ❌ @EiffL

How to sign

Post the following comment exactly as written:

I have read the Developer Certificate of Origin and I hereby sign the DCO for this PR

[aboucaud]

I have read the Developer Certificate of Origin and I hereby sign the DCO for this PR