build(ci): bump ty to 0.0.70 and skip the PR title check for Dependabot

[r0ny123]

Summary

Two CI fixes. Bumps the pinned ty from 0.0.68 to 0.0.70, downgrading the two rules that release introduced and fixing the one genuine type error it surfaced, so make typecheck goes back to exiting 0. Also exempts Dependabot from the Semantic PR Title check, which currently fails on every dependency update.

Why the bump is not mechanical

ty 0.0.70 turns an unchanged tree red: 36 error[...] diagnostics, where 0.0.67, 0.0.68 and 0.0.69 all report the same 229 diagnostics with none at error level and exit 0. The Code Quality job fails on any PR that picks up the newer version. The 36 split into two unrelated causes.

34 are new rules that the config opts into before they exist. unsound-return-statement (29 hits) and unsound-yield (5) are new in 0.0.70 and ship with severity ignore — checking this tree against stock rule defaults produces zero of them. They are errors here only because [tool.ty.rules] all = "error" enables every rule the checker has, including ones added after that line was written. Both fire wherever a value inferred as Unknown reaches an annotated return or yield, which is most of a largely unannotated codebase; the sites cluster in Disassembler.py, SmdaReport.py, SmdaFunction.py, the Delphi label providers, the three synthesizers and StringExtractor.py. ty's suggested remedy is an assert at each site, which would add runtime work and noise for no behavioral gain, so both rules are set to warn — the same treatment unresolved-attribute already gets for third-party dynamism. They stay visible in output and are non-blocking under error-on-warning = false.

2 are real, and come from an inference improvement. SmdaFunction and SmdaReport both declare binweight = 0, so its type infers as int, while SmdaFunction._parseBlocks deliberately accumulates float(sum(...)) into it — the value is serialized, so it has to stay a float. 0.0.70 started catching the widening; earlier versions did not.

Changes

• pyproject.toml: pin moved to ty==0.0.70, with the pin comment restated around the actual mechanism (all = "error" opting into not-yet-existing rules) rather than "adds lint rules in patch releases".
• pyproject.toml: unsound-return-statement and unsound-yield set to warn in [tool.ty.rules].
• SmdaFunction and SmdaReport: binweight annotated as float.

The binweight default literal stays 0 rather than becoming 0.0 on purpose. It reaches toDict() output for a function with no blocks, so 0.0 would change the serialized form of existing reports. This is an annotation-only change with no runtime effect.

Dependabot and the PR title check

Dependabot titles its PRs build(deps-dev): ... or build(deps): ..., and neither scope is on the workflow's allowlist, so every dependency update opens with a failing required check — #242 is the current example. The title is generated by the bot, and a maintainer cannot edit it without closing the PR, so there is no way to clear the failure other than merging past it.

The job is now skipped for PRs opened by dependabot[bot], rather than adding deps/deps-dev to the scope list, which would also let a human PR use them. Because the workflow runs on pull_request_target, it is evaluated from the base branch's copy — the skip takes effect for Dependabot PRs once this is merged, and does not retroactively clear the check on #242.

Validation

make lint          # exit 0
make typecheck     # exit 0 — 263 diagnostics, 0 errors
make test          # 1181 passed, 1 skipped, 1480 subtests, exit 0

Diff coverage of the two changed source lines is 100% against master.

The "no errors under stock defaults" claim above was checked directly, by running 0.0.70 with a configuration that silences only the pre-existing import/attribute noise and leaves every other rule at its shipped severity; neither unsound-* rule produced a diagnostic. The version boundary was bisected by running 0.0.68, 0.0.69 and 0.0.70 against this same tree.