test: annotations + coverage for the supervise RPC seam

Add pyright-strict parameter/return annotations to the fake resolvers and
test helpers, and cover the new control-plane validation/403 branches
(/supervise/propose + /supervise/poll) plus the supervise-server and egress
poll-error fail-closed paths, so the diff-coverage gate stays above 90%.
No production behavior change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_policy_resolver.py

@@ -144,6 +144,7 @@ class TestPolicyResolver(unittest.TestCase):
             {"status": "approved", "notes": "ok", "final_file": None})
         ) as m:
             result = self.r.poll_supervise("10.243.0.7", "tok", "p-7")
+        assert result is not None
         self.assertEqual("approved", result["status"])
         req = m.call_args.args[0]
         self.assertTrue(req.full_url.endswith("/supervise/poll"))