fix(tests): resolve pyright strict errors in forge test helpers

CI runs `pyright .` over the whole repo including tests; the earlier
run only checked the source paths. The test helpers used `**over`
dict-splat into typed constructors, which pyright strict rejects.

- forge_state: build a typed ForgeState base and dataclasses.replace(**over)
- provenance: explicit typed keyword params instead of a **over dict
- resume: _launch_kwargs returns dict[str, Any] (copy call_args.kwargs)
- forge_base: assert PermissionError in __mro__ (avoids always-true issubclass)
- client: annotate _resp body param; type: ignore the mock __enter__ lambda

pyright . now 0 errors; 47 tests still pass; pylint 9.97/10.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WL77TgFxKbs3cidGMG9dz7

tests/unit/test_contrib_gitea_provenance.py

@@ -7,16 +7,29 @@ import unittest
 from bot_bottle.contrib.gitea.provenance import build_provenance_footer
 
 
-def _footer(slug: str = "implementer-abc12", **over) -> str:
-    base = {
-        "agent_name": "implementer",
-        "bottle_names": ("claude",),
-        "started_at": "2026-06-29T12:00:00-04:00",
-        "finished_at": "2026-06-29T12:04:12-04:00",
-        "exit_code": 0,
-    }
-    base.update(over)
-    return build_provenance_footer(slug, **base)
+def _footer(
+    slug: str = "implementer-abc12",
+    *,
+    agent_name: str = "implementer",
+    bottle_names: tuple[str, ...] = ("claude",),
+    started_at: str = "2026-06-29T12:00:00-04:00",
+    finished_at: str = "2026-06-29T12:04:12-04:00",
+    exit_code: int = 0,
+    watchdog_fired: bool = False,
+    gitleaks_clean: bool | None = None,
+    egress_routes: list[str] | None = None,
+) -> str:
+    return build_provenance_footer(
+        slug,
+        agent_name=agent_name,
+        bottle_names=bottle_names,
+        started_at=started_at,
+        finished_at=finished_at,
+        exit_code=exit_code,
+        watchdog_fired=watchdog_fired,
+        gitleaks_clean=gitleaks_clean,
+        egress_routes=egress_routes,
+    )
 
 
 class ProvenanceTest(unittest.TestCase):