chore: complete strict-mypy burn-down (hard gate)

[makegov-mark]

Summary

Completes the strict-mypy burn-down for tango/shapes/ (the ~24/28 pre-existing errors lint.yml tracked) and flips the mypy CI step off continue-on-error — it's now a hard gate. tango/ type-checks cleanly under strict mypy.

What changed

• FieldSchema.nested_model annotation fixed to type | str | None. It always accepted string model names from the explicit schemas; the old type | None was a genuine bug that masked 60+ latent arg-type errors (surfaced the moment the shadowed-type issue was fixed). ModelFactory.validate_data and ShapeParser._validate_field_spec now accept type | str for the model arg to match.
• ShapeParser registry: replaced the lazy-init bool-flag pattern with an _ensure_registry() helper so the registry narrows to non-None (kills five union-attr errors and the latent AttributeError risk they implied).
• Removed two provably-dead elif field_spec.is_wildcard: branches (TypeGenerator.generate_type, ModelFactory.create_instance) plus the now-orphaned _parse_nested_wildcard helper. Wildcard field specs are fully handled by the top-of-loop branch that continues before these are ever reached, so removal is behavior-preserving.
• Misc typing: cast on Any→type/str returns, field_type: Any, best_score = 0.0, builtins.type to disambiguate the shadowed type field, one scoped # type: ignore[unreachable] on a defensive isinstance(data, dict) guard.

Testing

• uv run mypy tango/ → clean (0 errors).
• ruff format --check + ruff check → clean.
• 420 passed, 1 skipped (non-production suite). No runtime behavior change.

Note for reviewers

The dead nested-wildcard branches looked like they handled recipient(*), but they never executed (the loop continues on any wildcard field first). If nested-wildcard expansion is actually desired, that's a separate, pre-existing bug — this PR doesn't change current behavior.

~ Mark