style: modernise typing and clean up lint findings

Repository-wide mechanical cleanup so `ruff check src tests` has a chance
of passing; no behavioural changes.

- Add `from __future__ import annotations` where PEP 604 unions are used.
  This has to come first: pyproject declares requires-python >= 3.9, where
  `X | None` is not evaluable at runtime unless annotations are stringified.
- Replace typing.List/Dict/Tuple/Set with the builtin generics and
  Optional[X] with X | None, then drop the imports that became unused.
  The four actions/*/__init__.py files needed this by hand because ruff
  leaves unused imports in __init__.py alone (possible re-exports).
- Strip shebangs from 72 importable modules. None of them are executable
  or invoked directly; the entry points are console_scripts and runpy.
- Flatten nested `with` blocks, collapse needless-bool returns, and apply
  the remaining mechanical ruff fixes (PIE810, FLY002, PERF102, FURB192,
  RUF059, I001).
- Pass check=False explicitly to the four subprocess.run() calls that
  inspect returncode themselves. That is the existing default.

Two rewrites are visible to mocks, so their tests move with them:
subprocess.run(stdout=PIPE, stderr=PIPE) became capture_output=True, and
open(path, "r", ...) lost the redundant mode.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/e2e/test_nix_build_pkgmgr.py

@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 """
 E2E test to inspect the Nix environment and build the pkgmgr flake
 in *every* distro container.
@@ -36,6 +34,7 @@ def _run_cmd(cmd: list[str]) -> subprocess.CompletedProcess:
         cmd,
         text=True,
         capture_output=True,
+        check=False,
     )
     print("[STDOUT]\n", proc.stdout)
     print("[STDERR]\n", proc.stderr)