style(1b): auto-format + lint-clean the whole codebase (RL1)

Mechanical, semantics-preserving cleanup so the codebase passes the new lint stage:
- ruff format: all 32 Python files (wraps long signatures, normalizes quotes/blank lines).
- nixpkgs-fmt: modules/drone-runner.nix.
- shfmt (-i 2 -ci): scripts/*.sh.

Lint fixes (reviewed, behavior-preserving — no test weakened):
- ruff SIM105: try/except-pass -> contextlib.suppress (abra.py app_config rm; lifecycle.py janitor).
- ruff SIM115: open().read() -> with open() (run_recipe_ci.py redaction-values + gitea-token).
- statix: merge repeated sops `secrets.*` keys into one `secrets = { ... }` (comments kept);
  empty fn pattern `{ ... }:` -> `_:` (packages.nix).
- deadnix: drop unused lambda args (flake `self`; configuration.nix `lib`; overlay `final` -> `_`).

Verified on cc-ci: `scripts/lint.sh` -> lint: PASS; nixosConfigurations.cc-ci evaluates;
all Python byte-compiles. The deployed bridge/dashboard/runner source changes hash (reformat),
so cc-ci will be rebuilt to the new closure in W2 before the cold D1-D10 re-verification.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dashboard/dashboard.py

@@ -11,6 +11,7 @@ ref, when, and a link to the canonical Drone run. Also serves an embeddable SVG
 Config (env): DRONE_URL, CI_REPO, DRONE_TOKEN_FILE, DASH_LISTEN (default 0.0.0.0:8080),
 POLL_INTERVAL (default 60), CACHE_TTL (default 30).
 """
+
 import html
 import json
 import os
@@ -34,8 +35,14 @@ DRONE_TOKEN = _read(os.environ["DRONE_TOKEN_FILE"])
 
 _CACHE = {"ts": 0.0, "recipes": []}
 
-_COLORS = {"success": "#3fb950", "failure": "#f85149", "error": "#f85149",
-           "running": "#d29922", "pending": "#d29922", "killed": "#8b949e"}
+_COLORS = {
+    "success": "#3fb950",
+    "failure": "#f85149",
+    "error": "#f85149",
+    "running": "#d29922",
+    "pending": "#d29922",
+    "killed": "#8b949e",
+}
 
 
 def log(*a):
@@ -43,8 +50,9 @@ def log(*a):
 
 
 def _drone(path):
-    req = urllib.request.Request(f"{DRONE_URL}{path}",
-                                 headers={"Authorization": f"Bearer {DRONE_TOKEN}"})
+    req = urllib.request.Request(
+        f"{DRONE_URL}{path}", headers={"Authorization": f"Bearer {DRONE_TOKEN}"}
+    )
     with urllib.request.urlopen(req, timeout=30) as resp:
         return json.loads(resp.read())
 
@@ -72,14 +80,16 @@ def latest_per_recipe():
     rows = []
     for recipe, b in sorted(latest.items()):
         ref = (b.get("params") or {}).get("REF") or ""
-        rows.append({
-            "recipe": recipe,
-            "status": b.get("status", "unknown"),
-            "number": b.get("number"),
-            "ref": ref[:8],
-            "finished": b.get("finished") or 0,
-            "url": f"{DRONE_URL}/{CI_REPO}/{b.get('number')}",
-        })
+        rows.append(
+            {
+                "recipe": recipe,
+                "status": b.get("status", "unknown"),
+                "number": b.get("number"),
+                "ref": ref[:8],
+                "finished": b.get("finished") or 0,
+                "url": f"{DRONE_URL}/{CI_REPO}/{b.get('number')}",
+            }
+        )
     return rows
 
 
@@ -163,7 +173,7 @@ class Handler(BaseHTTPRequestHandler):
         if path in ("/healthz", "/dashboard/healthz"):
             return self._send(200, "ok", "text/plain")
         if path.startswith("/badge/") and path.endswith(".svg"):
-            recipe = path[len("/badge/"):-len(".svg")]
+            recipe = path[len("/badge/") : -len(".svg")]
             row = next((r for r in recipes_cached() if r["recipe"] == recipe), None)
             status = row["status"] if row else "unknown"
             return self._send(200, render_badge(recipe, status), "image/svg+xml")