[BUG] `just check` (ty static typing) is red on master: 35 diagnostics from two rules already ignored in Autobahn|Python

[oberstet]

Problem

The Code Quality Checks CI job (just check cpy311 -> check-typing -> ty check)
fails on master, independently of any PR content. It was observed failing on
PR #2255 while every other job was green, and the diagnostics are entirely in files
that PR never touched (router/session.py, shell/repl.py, router/auth/cryptosign.py,
network/_backend.py, edge/node/docker.py, common/checkconfig.py).

ty reports:

Found 35 diagnostics

and those 35 are exactly two rules:

count	rule
19	warning[unused-type-ignore-comment]
16	warning[possibly-missing-submodule]

Both are warnings, yet ty exits non-zero, so the gate fails.

The gate is not missing — it has drifted

crossbar's check-typing recipe already uses the same ratcheted --ignore
allowlist pattern as Autobahn|Python (~27 ignore occurrences in the justfile vs
autobahn's ~31). The problem is that crossbar's allowlist is behind autobahn's:
both of the offending rules are already ignored in
autobahn-python's check-typing recipe:

--ignore possibly-missing-submodule \
--ignore unused-type-ignore-comment \

Autobahn|Python is the group's CI/CD gold standard (its typing gate was ratcheted in
autobahn#1840: pre-existing gaps are held in an explicit --ignore allowlist to be
removed module-by-module, while all other rules are enforced immediately). Crossbar
should track it.

Fix

Add the two missing --ignore flags to check-typing in crossbar's justfile,
mirroring autobahn-python's recipe, so the gate goes green and these two categories
become explicitly-tracked ratchet items rather than a permanently red job.

While here, worth answering (and recording in the issue):

• How did master go red? Either the gate was green and something merged past it,
  or a ty version bump enabled/renamed these rules. If it is a version bump, the
  group's shared recipes will drift again — consider pinning ty or syncing the
  allowlist across repos (autobahn / zlmdb / crossbar) as part of the fix.
• Are the 19 unused-type-ignore-comment hits worth fixing rather than ignoring?
  They indicate # type: ignore comments that are no longer needed — cheap to remove,
  and removing them is strictly better than ignoring the rule. Ignoring is the
  pragmatic unblock; removal is the real cleanup and could be ratcheted separately.

Why a separate issue

Found while working crossbar#2250 (WebSocket compression validator). Deliberately
not folded into that PR: #2250 is a security/config change, and burying a
repo-wide typing sweep in it would make it far harder to review. #2250's own red/green
is read off the Unit Tests workflow, which is green.

Acceptance criteria

• just check passes on master.
• The two rules are ignored via the explicit allowlist (or the underlying
  # type: ignore comments removed), consistent with autobahn-python.
• The cause of the drift is understood and recorded, so the gate cannot silently rot
  again.

References

• Observed on crossbar PR Fix 2250 #2255 (CI run 79624716834 red / 79637961011 green-except-this).
• Pattern to mirror: autobahn-python check-typing recipe; ratchet rationale in
  autobahn#1840.

This work is being completed with AI assistance (Claude Code).