chore: clean remaining ruff/mypy findings and enforce lint in CI

[AmirhosseinHonardoust]

Finishes the lint/type cleanup and adds enforcement.

• mypy: fix the 5 real type errors (dict annotations in
  threshold_policy and evaluate; float64 cast on rounded risk
  scores). mypy now reports 0 errors.
• ruff: split 5 E501 long strings, replace redundant # type: ignore
  with # noqa: E402 on app.py's post-sys.path imports, and convert
  4 SIM108 if/else blocks to ternaries.
• CI: add a lint job running ruff, black --check, and mypy.

Verified locally (clean env, linters only):

• ruff: all checks pass; black --check clean; mypy: 0 errors.
• 34/34 tests pass.
• Behavior unchanged: regenerated raw dataset is byte-identical
  (md5 match) and threshold_policy.md is byte-identical, confirming
  the string-split and astype edits are no-ops at runtime.

Note: the SHAP-path SIM108 edits run only at runtime/CI (shap not
installed locally); they are equivalent ternary rewrites and both
files compile.