fix(typecheck): pin mypy's analysis platform so results match CI

[ProjeetBhaumik]

Summary

make typecheck gates contributions, but mypy defaults to the host platform, so the same checkout answers differently depending on who runs it.

On d40f5d9 under Python 3.14:

$ uv run mypy --platform linux src
Success: no issues found in 305 source files

$ uv run mypy --platform win32 src
Found 3 errors in 3 files (checked 305 source files)

The three win32-only errors are all in src/agents/sandbox/, where tempfile and the unix_local paths differ between platforms in typeshed:

• src/agents/sandbox/util/tar_utils.py:161 — Incompatible return value type (got "_TemporaryFileWrapper[bytes]", expected "IOBase")
• src/agents/sandbox/sandboxes/unix_local.py:339 — Name "process" is used before definition
• src/agents/sandbox/sandboxes/docker.py:1430 — Argument "stream" ... has incompatible type "_TemporaryFileWrapper[bytes]"; expected "IOBase"

The typecheck job runs on ubuntu-latest, so CI never exercises the win32 result. A Windows contributor sees three failures they did not cause and cannot act on.

Pinning mypy to Linux makes the gate reproducible and makes it report what CI actually enforces.

Why pyright is left alone

The issue covers make typecheck, which runs mypy and pyright, so the symmetric change would be "pythonPlatform": "Linux" in pyrightconfig.json. I tried that and backed it out, because it makes things worse off-Linux.

Pyright resolves the host's real installed stdlib rather than bundled stubs, so forcing pythonPlatform to Linux on a macOS host produces a hybrid environment that no real machine sees. Measured on macOS, same venv, back to back:

	pyright
main	0 errors
main + "pythonPlatform": "Linux"	14 errors in tests/

Those 14 are spurious — a real Linux machine and a real macOS machine both report 0. Pyright's platform default is already the right behaviour, so this PR touches mypy only.

Note on a second, separate axis

While measuring this I hit a different source of nondeterminism, which this PR does not address: mypy's results also vary by interpreter version. Under Python 3.10 the tree reports 5 errors on any platform (4 in archive_ops.py for SpooledTemporaryFile vs IOBase, 1 in run_loop.py for BaseExceptionGroup), and 0 under 3.11+. uv sync resolves 3.10 locally when there is no .python-version file, while CI pins 3.14 and sees none of them.

That looks worth a separate decision — either pinning the dev interpreter or type-checking the supported floor — so I left it out rather than bundling it here. Happy to follow up if you have a preference.

Test plan

Python 3.14.7 on macOS, uv sync --all-extras --all-packages --group dev:

• bash .agents/skills/code-change-verification/scripts/run.sh — all commands passed (make lint 38s, make tests 265s, make typecheck 305s)
• make typecheck on this branch — mypy Success: no issues found in 305 source files, pyright 0 errors, 0 warnings, 0 informations
• Confirmed the config key takes effect by flipping it to win32 and re-running: 3 errors, matching the --platform win32 override

One caveat, for transparency: two earlier full-suite runs on this machine each hit a single different timeout-based failure (test_stop_terminates_active_pty_sessions, then test_read_path_probe_resolves_symlinks_before_classifying_missing). Both pass in isolation and both passed in the final run; they appear to be load-induced on my hardware rather than related to this change, which touches no runtime code.

Issue number

Closes #4477

Checks

• I've added new tests (if relevant) — n/a, configuration-only change with no runtime behaviour
• I've added/updated the relevant documentation — n/a, the rationale is a comment at the config site
• I've run make lint and make format
• I've made sure tests pass

[ProjeetBhaumik]

Closing in favour of #4482, which fixes the three errors at the source rather than pinning the analysis platform. That is the better fix: I checked it out locally and it clears the full tree on both mypy --platform win32 src and --platform linux src (305 files, no issues either way), not just the three modules its test plan lists.