chore(types): enable warn_return_any and cast all no-any-return sites

Turn on mypy warn_return_any (pyproject) and resolve the 84 resulting
[no-any-return] errors across 43 files with typing.cast() at the return
sites — runtime no-ops that make the declared return type explicit where a
dependency (SQLAlchemy scalar/first/one, httpx .json(), subprocess, docker
SDK) hands back Any. No behavior change: no DTO/table field types altered, no
validation/coercion calls added, every cast reflects the true runtime type.

Locks in return-type strictness so the class of bug where a function silently
widens to Any can't regress. mypy decnet/ clean; adversarially verified
behavior-preserving (84 casts 1:1 with prior returns).

Bump tornado 6.5.5 -> 6.5.7 (CVE-2026-49854, transitive via snakeviz).

decnet/ttp/attack_stix.py

@@ -39,7 +39,7 @@ from dataclasses import dataclass
 from functools import lru_cache
 from pathlib import Path
 from threading import Lock
-from typing import TYPE_CHECKING, Final
+from typing import TYPE_CHECKING, Final, cast
 
 if TYPE_CHECKING:
     from mitreattack.stix20 import MitreAttackData
@@ -310,7 +310,7 @@ def subtechnique_parent_name(technique_id: str) -> str | None:
     )
     if not parents:
         return None
-    return parents[0]["object"].name
+    return cast(str, parents[0]["object"].name)
 
 
 def is_subtechnique(technique_id: str) -> bool:
@@ -335,7 +335,7 @@ def tactic_id_for_short_name(short_name: str) -> str | None:
         return None
     for ref in obj.get("external_references", []):
         if ref.get("source_name") == "mitre-attack":
-            return ref.get("external_id")
+            return cast(str | None, ref.get("external_id"))
     return None