✨ feat(plugin): type the plugin and internal API surfaces - #4014

Plugin authors work against surfaces tox types as Any: every conf["key"] read needs a cast, the tox_on_install hook gives no clue what arguments holds, and a typo in options.<name> only surfaces at runtime. 🧩 This change types those surfaces so editors complete them and type checkers verify them, for plugins and for tox itself.

ConfigSet.get(key, of_type) returns a configuration value verified at runtime against its declared type, while the Any-returning conf["key"] stays for compatibility. The tox_on_install hook and Installer.install receive InstallArguments, a named union of what tox installs; Installer gained a second type parameter that defaults to this union, so existing Installer[MyEnv] subclasses keep working. Parsed declares the CLI option surface, add_config accepts default=None and infers value types from callable defaults (removing six of the seven suppressions for astral-sh/ty#2428), persisted JSON documents share a JsonValue alias, and package plus run modes became Literal types. ✨ To keep this true over time, the type environment now runs mypy in strict mode and pyrefly after ty, each as its own command so ty keeps finishing in under a second, and tests/type_check/ pins the inference behavior of the new APIs under all three checkers.

The added checkers caught three bugs: reporting annotated colorama colors as int although they hold ANSI escape strings, a pyproject.toml with a non-table tool.tox or env_base raised a traceback instead of an error, and the structured { product = ... } form accepted a non-list exclude. 🐛 Beyond those, runtime behavior does not change; typing-extensions becomes a runtime dependency below Python 3.13 to supply TypeVar defaults, and each remaining suppression names its error code and the upstream gap it works around.