chore: enforce type-checking-only imports with ruff

[cloudsmith-iduffy]

Description

The perf work in this stack moved a lot of imports into if TYPE_CHECKING: blocks by hand — imports that are only needed for type annotations don't have to be paid for at runtime. This makes that a rule so it can't quietly regress.

Two ruff rule groups are now enabled:

• flake8-type-checking (TC) — if an import is only used in type annotations, it has to live in an if TYPE_CHECKING: block, which means the interpreter never actually imports it
• flake8-future-annotations (FA) — makes sure from __future__ import annotations is present where it's needed, so the moved imports stay safe without quoting every annotation

There's nothing to set up: the pre-commit ruff hook picks the rules up from pyproject.toml, and CI runs pre-commit, so both enforce it.

Turning the rules on found 8 leftover typing-only imports across 5 files, all moved in this PR. The only one that needed real thought was EnvironmentDetector in the OIDC detectors package __init__ — moving it would break anything importing it from the package, but it turns out every subclass and test already imports it from .base directly, so the package-level name was dead weight.

This mirrors how the main cloudsmith repo configures ruff (it selects the same two groups). Its stdlib-json-to-orjson ban wasn't carried over: that's a binary dependency to speed up JSON payloads that are tiny here, and imports — not parsing — were the CLI's actual bottleneck.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Lint enforcement; no behaviour change.

Additional Notes

• Files that don't have from __future__ import annotations yet (e.g. core/mcp/server.py) are left alone — ruff only offers the move where it's provably safe, which is exactly what we want from a guard.
• The existing pre-commit excludes for the test directories still apply.
• Full suite passes (801 passed, 40 skipped).

🤖 Generated with Claude Code