Remove mypy from the repository

[akwasigroch]

Purpose

mypy was declared as a dev dependency in three projects but was barely wired in: the pre-commit hook had been commented out, and the only thing actually invoking it was a type-check Make target in the backend and penelope. Meanwhile penelope already carries pyright. This removes mypy so there is one type checker story instead of a half-configured second one, and drops the dead references that came with it.

What Changed

• Removed the mypy dev dependency from apps/backend/pyproject.toml, sdk/pyproject.toml and penelope/pyproject.toml, and relocked. The backend also drops librt, which came in only as a mypy dependency.
• Relocked the projects that path-depend on sdk/backend and therefore embed their dev groups: apps/chatbot, apps/polyphemus, examples/telemetry, agents/research-assistant, agents/travel-agent.
• Removed the backend's type-check Make target — it only ran mypy — along with its .PHONY and all references.
• penelope's type-check target now runs pyright, which is already a dev dependency there.
• Deleted the commented-out mirrors-mypy block from .pre-commit-config.yaml.
• Docs: penelope/CONTRIBUTING.md now names pyright only; apps/chatbot/README.md drops its mypy client.py endpoint.py line.
• Removed .mypy_cache/, .dmypy.json and dmypy.json ignore entries from the root, sdk and penelope .gitignores, from four .dockerignores, and from the skip-list in scripts/run_pip_audit_all.py.

Additional Context

• penelope's type-check is deliberately not in make all. pyright reports 19 pre-existing errors in penelope, so wiring it into all would hand everyone a red build. The target still works on demand, and a comment in the Makefile records why. Clearing those errors is follow-up work.
• Type stub packages are kept (types-requests, pandas-stubs, types-pytz, types-tqdm in the sdk; types-requests in penelope). pyright consumes stubs too, so removing them would be a separate, riskier change.
• agents/visit-prep could not be relocked. It path-depends on ../../../haystack-core-integrations, which is not present in this checkout, so uv lock fails on metadata generation. The single stale mypy line was removed by hand — exactly what uv lock would have done. A proper relock on a machine that has that repo would be worth doing at some point.
• Relocking the side projects pulled in a small amount of drift that was already stale in those locks: an exclude-newer timestamp bump, directory → editable source normalization, and rhesis-sdk 0.11.0 → 0.12.0. Roughly 4 added / 5 removed lines each.

Testing

• uv lock --check passes in apps/backend, sdk and penelope, confirming the locks match their manifests.
• grep -rn '\bmypy\b' across the repo returns nothing outside mypy-extensions, an unrelated transitive package.
• uvx ruff check scripts/run_pip_audit_all.py passes — the one Python file touched.
• make all in the backend and penelope no longer invokes a missing binary. make type-check in penelope runs pyright and reports the 19 pre-existing errors noted above.

[peqy]

Looks good. Removes a half-wired mypy setup cleanly (deps, Make targets, ignores, docs) and keeps penelope’s on-demand type-check via pyright as documented. Ship it.