style(1b): auto-format + lint-clean the whole codebase (RL1)

Mechanical, semantics-preserving cleanup so the codebase passes the new lint stage:
- ruff format: all 32 Python files (wraps long signatures, normalizes quotes/blank lines).
- nixpkgs-fmt: modules/drone-runner.nix.
- shfmt (-i 2 -ci): scripts/*.sh.

Lint fixes (reviewed, behavior-preserving — no test weakened):
- ruff SIM105: try/except-pass -> contextlib.suppress (abra.py app_config rm; lifecycle.py janitor).
- ruff SIM115: open().read() -> with open() (run_recipe_ci.py redaction-values + gitea-token).
- statix: merge repeated sops `secrets.*` keys into one `secrets = { ... }` (comments kept);
  empty fn pattern `{ ... }:` -> `_:` (packages.nix).
- deadnix: drop unused lambda args (flake `self`; configuration.nix `lib`; overlay `final` -> `_`).

Verified on cc-ci: `scripts/lint.sh` -> lint: PASS; nixosConfigurations.cc-ci evaluates;
all Python byte-compiles. The deployed bridge/dashboard/runner source changes hash (reformat),
so cc-ci will be rebuilt to the new closure in W2 before the cold D1-D10 re-verification.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/conftest.py

@@ -4,6 +4,7 @@ A run is parameterized by env: RECIPE, REF (PR head sha), PR, SRC (head repo). T
 computes a unique app domain per run so concurrent runs never collide, and GUARANTEES teardown
 (undeploy + volume + secret removal) via a finalizer, even on failure.
 """
+
 from __future__ import annotations
 
 import os
@@ -24,8 +25,12 @@ def _recipe_meta(recipe: str) -> dict:
     A recipe may ship tests/<recipe>/recipe_meta.py with any of: HEALTH_PATH (str),
     HEALTH_OK (tuple of status codes), DEPLOY_TIMEOUT (int), HTTP_TIMEOUT (int)."""
     path = os.path.join(os.path.dirname(__file__), recipe, "recipe_meta.py")
-    meta = {"HEALTH_PATH": "/", "HEALTH_OK": (200, 301, 302),
-            "DEPLOY_TIMEOUT": 600, "HTTP_TIMEOUT": 300}
+    meta = {
+        "HEALTH_PATH": "/",
+        "HEALTH_OK": (200, 301, 302),
+        "DEPLOY_TIMEOUT": 600,
+        "HTTP_TIMEOUT": 300,
+    }
     if os.path.exists(path):
         ns: dict = {}
         with open(path) as fh:
@@ -57,8 +62,13 @@ def meta(recipe) -> dict:
 
 
 def _wait_healthy(domain, meta):
-    lifecycle.wait_healthy(domain, ok_codes=tuple(meta["HEALTH_OK"]), path=meta["HEALTH_PATH"],
-                           deploy_timeout=meta["DEPLOY_TIMEOUT"], http_timeout=meta["HTTP_TIMEOUT"])
+    lifecycle.wait_healthy(
+        domain,
+        ok_codes=tuple(meta["HEALTH_OK"]),
+        path=meta["HEALTH_PATH"],
+        deploy_timeout=meta["DEPLOY_TIMEOUT"],
+        http_timeout=meta["HTTP_TIMEOUT"],
+    )
 
 
 @pytest.fixture