fix(ci): green the gates the ai_chat/ChatGateway commits reddened

[anthmFS]

Coordinated-With: porting-sdk@wave6/ctor-dunder-fold

What this is

The three ChatGateway commits (8b790ea, cac3118, 20663a6) landed on main
without a full run-ci, reddening four gates. This fixes each at its source.
It does not touch the gates that are wave6 coordination artifacts — see
"Not in scope" below.

Fixed

gate	before	after
LINT	FAIL	PASS
FMT	FAIL	PASS
NO-CHEAT	FAIL	PASS
TYPECHECK	105 errors	clean on every file CI reports

LINT — RUF022 (__all__ unsorted in ai_chat/__init__.py) and SIM102
(nested if in search/document_processor.py).

FMT — ruff format over ai_chat/gateway.py and core/function_result.py.
Applied with the pinned ruff==0.15.21; a newer ruff reformats 19 files
instead of 2, which is exactly what the pin in requirements-dev.txt exists to
prevent.

TYPECHECK — two root causes, not 105 problems:

• tests/unit/ai_chat/test_gateway.py shipped fully unannotated (44
  no-untyped-def + 19 no-untyped-call). The mypy config puts tests in
  scope deliberately — "a new untyped test fails the gate" — so it is annotated
  throughout.
• FunctionResult.response widened to str | dict[str, Any], so 37 sites doing
  .response.lower() stopped type-checking. Each gets
  assert isinstance(<r>.response, str) beside the existing
  assert isinstance(<r>, FunctionResult): a real assertion that narrows the
  union and pins the contract, not a cast papering over it.
• FunctionResult.hold: bool subclasses int, so excluding bools from the
  back-compat int-swap left str | bool. Handled explicitly. hold(120) still
  means hold(timeout=120) — the existing back-compat shim is untouched.
• ChatGateway.visible_messages / last_activity accept None and non-dict
  items by design (for msg in messages or [],
  if not isinstance(msg, dict): continue) and are tested for it, but were
  typed list[dict[str, Any]]. Widened to match the real contract. Free to
  change: ChatGateway is new surface no port has implemented yet.

NO-CHEAT — three origin tests asserted nothing at all, so they passed
regardless of whether the code worked. Each now pairs the allowed case with the
refusal that proves it is a deliberate exemption and not open-by-default:
localhost vs an unlisted origin, a listed origin vs a lookalike domain, and
absent vs present-but-unlisted.

Verification

• LINT, FMT, NO-CHEAT pass; 29 other gates pass.
• mypy clean over all 8 files CI reports.
• Full unit suite: 5940 passed.
• The 6 remaining mcp_gateway failures are pre-existing — verified by
  stashing this branch's changes and running them on unmodified main, where
  they fail identically. They are environment-dependent and CI passes them.

Not in scope (deliberately)

GEN-FRESH, DRIFT, SEMVER-DIFF and DOC-AUDIT's unresolved router are
coordinated-pin artifacts, not defects in this code. PORTING_SDK_REF is
set to wave6/ctor-dunder-fold, so CI builds against that branch — which was
cut before the ChatGateway commits and therefore has no ChatGateway in its
oracle. Regenerating the oracle standalone is not possible: doing it on top of
wave6 produces an 877+/544- diff whose deletions are wave6-only surface that
main does not have.

That half is already PR #78's ("wave6: the reference half of the coordinated
pass"), which regenerates those exact generated files and whose test jobs pass
on 3.10-3.13. Those gates resolve when the wave lands with main's commits
absorbed.

Worth noting separately: mypy is unpinned (mypy>=1.8) in
requirements-dev.txt while ruff is pinned exact. It happened to resolve to
2.3.0 both locally and in CI, but that is luck — same local-vs-CI drift class
the ruff pin was added to stop.

🤖 Generated with Claude Code

https://claude.ai/code/session_015dYktt85Ltj3oK9gG5VBww