Improve type safety ahead of PII system work

[binaryaaron]

Summary

• Track follow-up type-safety improvements needed before broader PII system work.
• Focus on dynamic runtime boundaries: config patches, JSON/record payloads, NER metadata, CLI/tooling inputs, and PII replacer internals.
• Prefer typed boundary models, TypeIs guards, protocols, and narrow helpers over Any, unchecked casts, or local type ignores.

Current stack

• chore: update ty to 0.0.44 #608 updates ty and fixes checker-surfaced compatibility issues.
• refactor(config): centralize sparse config patch validation #609 centralizes sparse config patch validation.
• refactor(records): add JSON record boundaries #610 adds JSON and NER payload boundaries.
• refactor: tighten checked-source typing coverage #611 tightens checked-source typing coverage.
• chore(typecheck): include top-level tools #612 includes top-level tools in type checks.
• refactor(pii): type NER payload and runtime boundaries #613 brings PII replacer runtime boundaries under ty.

Follow-up

• Audit remaining Any, cast, and type-ignore usage in PII-adjacent paths.
• Add typed payload boundaries where data crosses from config, records, generated JSON, or NER outputs into PII workflows.
• Keep test coverage focused on behavior at those boundaries.