Closes #743

Problem

.pre-commit-config.yaml pinned tool versions independently from uv.lock, creating two separate sources of truth that could silently drift. The concrete failure reported in #743: the ty-check hook used additional_dependencies ["ty>=0.0.24"], which pre-commit resolved to the latest available ty release — newer than the version locked in uv.lock.
The newer release tightened type inference, turning existing # ty: ignore comments into errors and making just check fail on a fresh clone.

The same structural problem affected ruff, which was pinned to a specific tag in the astral-sh/ruff-pre-commit external repo independently of uv.lock.

Solution

Replace all external pre-commit repos for Python tools (ruff, codespell, ty) with local hooks that invoke tools via uv run --frozen. This way the version is always determined by uv.lock — no version number appears in .pre-commit-config.yaml itself.

• ruff and ty were already in the dev dependency group; their external repo blocks (astral-sh/ruff-pre-commit, and the additional_dependencies trick for ty) are replaced by language: system hooks.
• codespell is added to the dev dependency group and locked in uv.lock, then made a local hook as well.
• pre-commit/pre-commit-hooks remains an external repo since it has no equivalent package in the project.

Codespell configuration (skip patterns, exclude file) is moved from inline hook args into [tool.codespell] in pyproject.toml, so the settings apply consistently regardless of how codespell is invoked.
The skip list is also extended to cover PDF files (which produce binary false positives) and the bundled typst_fontawesome third-party library.

Testing

uv run --frozen codespell exits clean.
uv run --frozen prek validate-config .pre-commit-config.yaml reports
success.