Enforce strict Pyright gate

src/docforge/config_validation.py

@@ -3,8 +3,9 @@
 from __future__ import annotations
 
 import re
+from collections.abc import Mapping
 from pathlib import Path
-from typing import Any
+from typing import cast
 
 from .errors import DocForgeError
 
@@ -13,7 +14,7 @@ AUTHORITIES = frozenset({"authoritative", "approved_plan", "derived", "proposal"
 _SECRET_PARTS = frozenset({".git", ".ssh", ".gnupg", "secrets", "credentials"})
 
 
-def require_string(document: dict[str, Any], key: str, source: Path) -> str:
+def require_string(document: Mapping[str, object], key: str, source: Path) -> str:
     value = document.get(key)
     if not isinstance(value, str) or not value.strip():
         raise DocForgeError("invalid_source", f"{source.name}: {key} must be a non-empty string")
@@ -21,11 +22,16 @@ def require_string(document: dict[str, Any], key: str, source: Path) -> str:
 
 
 def string_list(value: object, *, key: str, source: Path) -> tuple[str, ...]:
-    if not isinstance(value, list) or any(not isinstance(item, str) or not item for item in value):
+    if not isinstance(value, list):
         raise DocForgeError("invalid_source", f"{source.name}: {key} must be a string list")
-    if len(value) != len(set(value)):
+    items: list[str] = []
+    for item in cast(list[object], value):
+        if not isinstance(item, str) or not item:
+            raise DocForgeError("invalid_source", f"{source.name}: {key} must be a string list")
+        items.append(item)
+    if len(items) != len(set(items)):
         raise DocForgeError("invalid_source", f"{source.name}: {key} contains duplicates")
-    return tuple(value)
+    return tuple(items)
 
 
 def confined_path(