ty: type checking as a first-class gate

[Syndic]

Summary

• Adds [tool.ty] to root pyproject.toml (env py314, src = ["meta", "tools"], excludes mirror ruff's). Rule severities left at ty's defaults; tighten as real code surfaces categories worth escalating.
• Installs ty in the devcontainer via uv tool install, reusing the UV_TOOL_{BIN_DIR,DIR} declaration from the ruff layer. TY_VERSION ARG is Renovate-tracked (pypi:ty).
• New ty CI job: astral-sh/setup-uv@v6 → uv sync (so ty can resolve requests for the smoke target) → uvx ty@<pin> check. Added to build-and-test-per-target.needs.
• post-create.sh now runs uv sync so the astral-sh.ty editor extension has a .venv to resolve against.
• Wires the astral-sh.ty VS Code extension in both devcontainer.json and .vscode/extensions.json.
• Widens renovate.json's workflow-yaml regex from [a-z-]*version: to [A-Za-z_-]*[Vv]ersion: so the TY_VERSION: env-var key is trackable. Follows the precedent of PR ruff: format + lint as a first-class gate #123, which widened the matcher to handle the prior python-version: site.
• README: new ty row in the CI table, on-save table, and recommended-extensions list.

This is PR 3 of the Python tooling bootstrap (continuation plan).

Test plan

Run inside the devcontainer:

• ruff format --check . clean
• ruff check . clean
• ty check clean (1 finding — requests unresolved — fixed by adding uv sync to CI and post-create)
• bazel test //... — 11/11 pass
• bazel run //:gazelle -- -mode=diff clean
• pre-commit run --all-files clean

CI:

• ty job green on first push
• build-and-test-per-target rows gate on the new needs: entry