style: modernise typing and clean up lint findings

Repository-wide mechanical cleanup so `ruff check src tests` has a chance
of passing; no behavioural changes.

- Add `from __future__ import annotations` where PEP 604 unions are used.
  This has to come first: pyproject declares requires-python >= 3.9, where
  `X | None` is not evaluable at runtime unless annotations are stringified.
- Replace typing.List/Dict/Tuple/Set with the builtin generics and
  Optional[X] with X | None, then drop the imports that became unused.
  The four actions/*/__init__.py files needed this by hand because ruff
  leaves unused imports in __init__.py alone (possible re-exports).
- Strip shebangs from 72 importable modules. None of them are executable
  or invoked directly; the entry points are console_scripts and runpy.
- Flatten nested `with` blocks, collapse needless-bool returns, and apply
  the remaining mechanical ruff fixes (PIE810, FLY002, PERF102, FURB192,
  RUF059, I001).
- Pass check=False explicitly to the four subprocess.run() calls that
  inspect returncode themselves. That is the existing default.

Two rewrites are visible to mocks, so their tests move with them:
subprocess.run(stdout=PIPE, stderr=PIPE) became capture_output=True, and
open(path, "r", ...) lost the redundant mode.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/integration/test_visibility_integration.py

@@ -7,14 +7,14 @@ import tempfile
 import types
 import unittest
 from contextlib import redirect_stdout
-from typing import Any, Dict, List, Optional, Tuple
+from typing import Any
 from unittest.mock import patch
 
 from pkgmgr.actions.mirror.setup_cmd import setup_mirrors
 from pkgmgr.actions.mirror.visibility_cmd import set_mirror_visibility
 from pkgmgr.core.remote_provisioning.types import RepoSpec
 
-Repository = Dict[str, Any]
+Repository = dict[str, Any]
 
 
 class _FakeRegistry:
@@ -45,13 +45,13 @@ class FakeProvider:
 
     def __init__(self) -> None:
         # maps (host, owner, name) -> private(bool)
-        self.privacy: Dict[Tuple[str, str, str], bool] = {}
-        self.calls: List[Tuple[str, Any]] = []
+        self.privacy: dict[tuple[str, str, str], bool] = {}
+        self.calls: list[tuple[str, Any]] = []
 
     def can_handle(self, host: str) -> bool:
         return True
 
-    def _candidate_hosts(self, host: str) -> List[str]:
+    def _candidate_hosts(self, host: str) -> list[str]:
         """
         Be tolerant against host normalization differences:
         - may contain scheme (https://...)
@@ -75,7 +75,7 @@ class FakeProvider:
                 candidates.append(c.split(":", 1)[0])
 
         # de-dup
-        out: List[str] = []
+        out: list[str] = []
         for c in candidates:
             if c not in out:
                 out.append(c)
@@ -94,7 +94,7 @@ class FakeProvider:
         self.privacy[(spec.host, spec.owner, spec.name)] = bool(spec.private)
         return types.SimpleNamespace(status="created", message="created", url=None)
 
-    def get_repo_private(self, token: str, spec: RepoSpec) -> Optional[bool]:
+    def get_repo_private(self, token: str, spec: RepoSpec) -> bool | None:
         self.calls.append(("get_repo_private", (token, spec)))
         for h in self._candidate_hosts(spec.host):
             key = (h, spec.owner, spec.name)
@@ -113,7 +113,7 @@ class FakeProvider:
         self.privacy[(spec.host, spec.owner, spec.name)] = bool(private)
 
 
-def _mk_ctx(*, identifier: str, repo_dir: str, mirrors: Dict[str, str]) -> Any:
+def _mk_ctx(*, identifier: str, repo_dir: str, mirrors: dict[str, str]) -> Any:
     return types.SimpleNamespace(
         identifier=identifier,
         repo_dir=repo_dir,