chore(types): enable warn_return_any and cast all no-any-return sites

Turn on mypy warn_return_any (pyproject) and resolve the 84 resulting
[no-any-return] errors across 43 files with typing.cast() at the return
sites — runtime no-ops that make the declared return type explicit where a
dependency (SQLAlchemy scalar/first/one, httpx .json(), subprocess, docker
SDK) hands back Any. No behavior change: no DTO/table field types altered, no
validation/coercion calls added, every cast reflects the true runtime type.

Locks in return-type strictness so the class of bug where a function silently
widens to Any can't regress. mypy decnet/ clean; adversarially verified
behavior-preserving (84 casts 1:1 with prior returns).

Bump tornado 6.5.5 -> 6.5.7 (CVE-2026-49854, transitive via snakeviz).

decnet/bus/base.py

@@ -22,7 +22,7 @@ import asyncio
 import time
 import uuid
 from dataclasses import dataclass, field
-from typing import Any, AsyncIterator
+from typing import Any, AsyncIterator, cast
 
 EVENT_SCHEMA_VERSION = 1
 
@@ -203,4 +203,4 @@ async def _next_or_stop(queue: "asyncio.Queue[Any]") -> Event:
     item = await queue.get()
     if item is _CLOSE_SENTINEL:
         raise StopAsyncIteration
-    return item
+    return cast(Event, item)

decnet/bus/factory.py

@@ -17,7 +17,7 @@ env-driven dispatch, optional telemetry wrapping).  Callers MUST use
 from __future__ import annotations
 
 import os
-from typing import Any
+from typing import Any, cast
 
 from decnet.bus.base import BaseBus
 
@@ -81,6 +81,6 @@ def _maybe_wrap_telemetry(bus: BaseBus) -> BaseBus:
     except ImportError:
         return bus
     try:
-        return wrap_repository(bus)
+        return cast(BaseBus, wrap_repository(bus))
     except Exception:  # pragma: no cover - defensive
         return bus

decnet/bus/fake.py

@@ -14,7 +14,7 @@
 from __future__ import annotations
 
 import asyncio
-from typing import Any
+from typing import Any, cast
 
 from decnet.bus.base import (
     BaseBus,
@@ -51,7 +51,7 @@ class _FakeSubscription(Subscription):
         item = await self._queue.get()
         if item is _CLOSE_SENTINEL:
             raise StopAsyncIteration
-        return item
+        return cast(Event, item)
 
     async def _aclose(self) -> None:
         self._bus._unregister(self)

decnet/bus/unix_client.py

@@ -26,7 +26,7 @@ import asyncio
 import contextlib
 import os
 import pathlib
-from typing import Any
+from typing import Any, cast
 
 from decnet.bus import protocol
 from decnet.bus.base import (
@@ -61,7 +61,7 @@ class _UnixSubscription(Subscription):
         item = await self._queue.get()
         if item is _CLOSE_SENTINEL:
             raise StopAsyncIteration
-        return item
+        return cast(Event, item)
 
     async def _aclose(self) -> None:
         await self._bus._unregister(self)