Where do you start adding type hints to an existing project

At the boundaries: function signatures on public modules first, internals never. Run the checker in non-blocking mode for a few weeks so the noise is visible without stopping anyone, then turn on strictness one module at a time.

When the command genuinely is a shell pipeline you control end to end, and never with any value that came from outside the program. The list form avoids quoting entirely, which is both safer and easier to read.

Keep the work in functions, put argument parsing in main(), and guard with if __name__ == "__main__": sys.exit(main()). Return codes from main then work for both the shell and the tests.

Doing it once and never verifying. The setup is the visible part, so it gets attention, and the check that would catch a silent failure never gets written.