Lint clean: adopt the PR's type/style gate, apply it to the current tree, and drop its path filter

PR #3 proposed adding mypy and flake8 to CI, with configurations for both. The idea is right and the
configurations are kept. Three things about the PR itself needed correcting, and all three were found
by running the gate rather than reading the diff:

  1. It was written against an older tree. Its own edits reference code that no longer exists there
     (`unknown, positions, warnings = ...`, a `struct` import at line 857 that is used 600 lines
     later), so merging it as-is would have removed a live import. The fixes were re-derived against
     the current tree instead, and the PR is superseded.
  2. It added a `paths:` filter to the workflow, watching only `*.py` plus the two lint configs. That
     would stop `check_refs.py` and `check_routing.py` -- documentation gates -- from running on a
     documentation-only commit, which is exactly the change they exist to catch. The workflow keeps
     the PR's `actions/*@v7` bump and gains no filter; the reason is written next to the trigger.
  3. `pip install --upgrade pip pytest` was dropped to just the packages, because upgrading pip in CI
     is not a goal and can fail for reasons unrelated to this repository.

What the gate found on the current tree, and what was done about it -- 70 flake8 findings and 3 mypy
errors, none of which were cosmetic-only:

  F401 (23)  unused imports, removed. These were safe to delete because the import statement itself
             cannot have a side effect that matters here.
  F841 (12)  unused bindings, handled three ways rather than one. Dead code was deleted
             (`mt_mcp_probe.print_waiting_help`'s `host`, `repack.py`'s `signer_jar`); a computed
             value that was then forgotten was **wired up** (`rasc_build.py` now names the linker
             target in its build-failure hint instead of discarding it); and a binding that is
             intentional kept its place with `# noqa: F841` and the reason -- `java2c_probe` reads
             dex header fields one by one against the format spec, and deleting three of them to
             please a linter would have made the parser stop lining up with the format it implements.
  E741 (14)  the ambiguous loop name `l`, renamed with an AST pass that resolves each binding to its
             own scope. A regex rename would have been wrong: several scopes bind their own `l`.
             That pass had a defect of its own -- it treated a comprehension target as living in the
             comprehension scope while leaving references to it in the enclosing one -- which
             produced seven `undefined name 'l'`. Found by running flake8, fixed, and the counting
             bug is documented in `check_routing.py`, whose own `tables()` had the same class of
             error in the other direction.
  style      continuation indents, blank lines between top-level definitions, and lines over length.
             The line limit is 160, not 120, and the number is a **measurement**: this repository's
             secret-scanner rule table holds raw regex source of 148 and 156 characters, which cannot
             be split without changing the pattern.
  mypy (3)   two missing annotations on module-level containers, and one optional-dependency rebind
             (`dexutil = None` after `except ImportError`) that is the repository's own idiom and
             now says so with a `type: ignore[assignment]` and the reason. No code was reordered to
             satisfy the checker.

Verified on a venv containing only `mypy` and `flake8` -- the poorest environment the configuration
must work in, and the one CI uses: **flake8 reports 0, mypy reports "Success: no issues found in 55
source files"**. Behaviour is unchanged: 625 passed / 163 skipped / 25 xfailed, the same five gates
green (check_repo 0 problem, check_refs 0 dangling, check_routing coherent, check_budget 0 failure,
check_commands 0 drift), and every key script still prints help.

  .flake8        new, with the line-length and complexity numbers and their reasons
  mypy.ini       new; optional imports declared, nothing excluded from the analysis
  ci.yml         `actions/*@v7`; new `lint` job on one interpreter; no path filter
  30 files       the findings above

.github/workflows/ci.yml

@@ -18,13 +18,19 @@
 #     rather than failing. Run it locally after downloading the sample.
 #
 # Coverage is therefore: static structure, documentation anchors, budget, command
-# references, pure parsers, CLI contracts and no-device flows. Nothing more is
-# claimed.
+# references, routing coherence, pure parsers, CLI contracts, typing/style lint and
+# no-device flows. Nothing more is claimed.
 name: ci
 
 on:
   push:
   pull_request:
+#
+# NOTE ON TRIGGERS: no `paths:` filter, deliberately. A filter that watches only
+# `*.py` and the lint configuration would skip the structural gates on exactly the
+# changes they exist to catch -- a reference index or a documented command edited
+# without touching a script. check_refs.py and check_routing.py are documentation
+# gates, so they have to run on documentation commits.
 
 permissions:
   contents: read
@@ -49,7 +55,7 @@ jobs:
       PYTHONUTF8: "1"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v5
         with:
@@ -88,3 +94,37 @@ jobs:
       - name: Summarise skipped and expected-failure coverage
         if: always()
         run: python -m pytest -q -ra --no-header -p no:cacheprovider 2>&1 | tail -n 40
+
+  lint:
+    # Static checks over the same tracked surface the local commands cover, so what passes locally
+    # cannot drift from what CI enforces. Both tools read their configuration (mypy.ini, .flake8)
+    # from the repository root automatically.
+    #
+    # The environment is deliberately bare -- only mypy and flake8, none of PyYAML, capstone, tiktoken
+    # or frida. That is the poorest environment the configuration must keep working in, which is what
+    # mypy.ini's ignore_missing_imports overrides exist for: CI exercises the fallbacks instead of a
+    # machine-local install hiding a regression.
+    #
+    # One interpreter, not the matrix: the checks are static, and the matrix's job is runtime
+    # behaviour, which lint does not observe. `check_routing.py` -- a gate the test job also runs --
+    # is deliberately not repeated here.
+    #
+    # Verified locally before being added: on a venv with only mypy and flake8, `flake8` reports 0 and
+    # `mypy` reports "Success: no issues found in 55 source files".
+    name: lint (mypy + flake8)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install lint dependencies
+        run: python -m pip install --upgrade mypy flake8
+
+      - name: mypy
+        run: mypy *.py skills/apk-reverse/scripts/*.py
+
+      - name: flake8
+        run: flake8 *.py skills/apk-reverse/scripts/*.py