style(1b): auto-format + lint-clean the whole codebase (RL1)

Mechanical, semantics-preserving cleanup so the codebase passes the new lint stage:
- ruff format: all 32 Python files (wraps long signatures, normalizes quotes/blank lines).
- nixpkgs-fmt: modules/drone-runner.nix.
- shfmt (-i 2 -ci): scripts/*.sh.

Lint fixes (reviewed, behavior-preserving — no test weakened):
- ruff SIM105: try/except-pass -> contextlib.suppress (abra.py app_config rm; lifecycle.py janitor).
- ruff SIM115: open().read() -> with open() (run_recipe_ci.py redaction-values + gitea-token).
- statix: merge repeated sops `secrets.*` keys into one `secrets = { ... }` (comments kept);
  empty fn pattern `{ ... }:` -> `_:` (packages.nix).
- deadnix: drop unused lambda args (flake `self`; configuration.nix `lib`; overlay `final` -> `_`).

Verified on cc-ci: `scripts/lint.sh` -> lint: PASS; nixosConfigurations.cc-ci evaluates;
all Python byte-compiles. The deployed bridge/dashboard/runner source changes hash (reformat),
so cc-ci will be rebuilt to the new closure in W2 before the cold D1-D10 re-verification.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/keycloak/kc_admin.py

@@ -1,5 +1,6 @@
 """Recipe-specific keycloak admin-API helpers (not harness). Used by the upgrade/backup stages to
 write a real data marker (a realm) into mariadb and verify it survives upgrade / backup-restore."""
+
 import json
 import ssl
 import sys
@@ -21,12 +22,20 @@ def admin_password(domain: str) -> str:
 
 
 def admin_token(domain: str, password: str, user: str = "admin") -> str:
-    data = urllib.parse.urlencode({
-        "grant_type": "password", "client_id": "admin-cli", "username": user, "password": password,
-    }).encode()
+    data = urllib.parse.urlencode(
+        {
+            "grant_type": "password",
+            "client_id": "admin-cli",
+            "username": user,
+            "password": password,
+        }
+    ).encode()
     req = urllib.request.Request(
-        f"https://{domain}/realms/master/protocol/openid-connect/token", data=data,
-        headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST")
+        f"https://{domain}/realms/master/protocol/openid-connect/token",
+        data=data,
+        headers={"Content-Type": "application/x-www-form-urlencoded"},
+        method="POST",
+    )
     with urllib.request.urlopen(req, timeout=30, context=_CTX) as r:
         return json.load(r)["access_token"]
 
@@ -36,8 +45,9 @@ def _admin(domain, token, path, method="GET", body=None):
     headers = {"Authorization": "Bearer " + token}
     if data:
         headers["Content-Type"] = "application/json"
-    req = urllib.request.Request(f"https://{domain}/admin{path}", data=data, headers=headers,
-                                 method=method)
+    req = urllib.request.Request(
+        f"https://{domain}/admin{path}", data=data, headers=headers, method=method
+    )
     try:
         with urllib.request.urlopen(req, timeout=30, context=_CTX) as r:
             return r.status

tests/keycloak/recipe_meta.py

@@ -1,6 +1,6 @@
 # Per-recipe harness config for keycloak (DB-backed: keycloak + mariadb). Read by the shared
 # conftest — enrolling this recipe needs NO change to runner/harness code (D5).
-HEALTH_PATH = "/realms/master"          # 200 JSON once keycloak is up (not "/", which redirects)
+HEALTH_PATH = "/realms/master"  # 200 JSON once keycloak is up (not "/", which redirects)
 HEALTH_OK = (200,)
-DEPLOY_TIMEOUT = 600                     # JVM + DB migration are slow on a 2-vCPU VM
+DEPLOY_TIMEOUT = 600  # JVM + DB migration are slow on a 2-vCPU VM
 HTTP_TIMEOUT = 600

tests/keycloak/test_backup.py

@@ -1,11 +1,12 @@
 """keycloak — backup/restore stage (D2): create a realm, backup, delete it (mutate), restore,
 assert the realm is back (mariadb restored to the backed-up state)."""
+
 import os
 import sys
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
-from harness import lifecycle  # noqa: E402
 import kc_admin  # noqa: E402
+from harness import lifecycle  # noqa: E402
 
 
 def test_backup_mutate_restore(deployed):
@@ -24,7 +25,8 @@ def test_backup_mutate_restore(deployed):
 
     # 3) restore -> realm returns
     lifecycle.restore_app(domain)
-    lifecycle.wait_healthy(domain, path="/realms/master", ok_codes=(200,),
-                           deploy_timeout=600, http_timeout=600)
+    lifecycle.wait_healthy(
+        domain, path="/realms/master", ok_codes=(200,), deploy_timeout=600, http_timeout=600
+    )
     tok2 = kc_admin.admin_token(domain, pw)
     assert kc_admin.marker_realm_exists(domain, tok2), "restore did not bring back the realm"

tests/keycloak/test_install.py

@@ -1,4 +1,5 @@
 """keycloak — install stage (recipe #2, DB-backed SSO; D2 install + D3 Playwright)."""
+
 import os
 import sys
 
@@ -23,6 +24,8 @@ def test_playwright_admin_login(deployed_app):
             page.goto(url, wait_until="domcontentloaded", timeout=45000)
             # admin console redirects to the login form; wait for a username field to render
             page.wait_for_selector("input#username, input[name='username']", timeout=30000)
-            assert "keycloak" in page.content().lower() or page.locator("input#username").count() > 0
+            assert (
+                "keycloak" in page.content().lower() or page.locator("input#username").count() > 0
+            )
         finally:
             browser.close()

tests/keycloak/test_upgrade.py

@@ -1,13 +1,14 @@
 """keycloak — upgrade stage (D2): deploy previous version, create a realm (DB data), upgrade to
 current/$REF, assert the app is healthy and the realm survived (mariadb data preserved)."""
+
 import os
 import sys
 
 import pytest
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
-from harness import lifecycle  # noqa: E402
 import kc_admin  # noqa: E402
+from harness import lifecycle  # noqa: E402
 
 
 @pytest.fixture
@@ -18,8 +19,13 @@ def old_app(recipe, app_domain, meta, request):
     lifecycle.janitor()
     request.addfinalizer(lambda: lifecycle.teardown_app(app_domain))
     lifecycle.deploy_app(recipe, app_domain, version=prev)
-    lifecycle.wait_healthy(app_domain, ok_codes=tuple(meta["HEALTH_OK"]), path=meta["HEALTH_PATH"],
-                           deploy_timeout=meta["DEPLOY_TIMEOUT"], http_timeout=meta["HTTP_TIMEOUT"])
+    lifecycle.wait_healthy(
+        app_domain,
+        ok_codes=tuple(meta["HEALTH_OK"]),
+        path=meta["HEALTH_PATH"],
+        deploy_timeout=meta["DEPLOY_TIMEOUT"],
+        http_timeout=meta["HTTP_TIMEOUT"],
+    )
     return app_domain, prev
 
 
@@ -31,8 +37,13 @@ def test_upgrade_preserves_realm(old_app, meta):
     assert kc_admin.marker_realm_exists(domain, tok), "marker realm not created"
 
     lifecycle.upgrade_app(domain, version=os.environ.get("VERSION") or None)
-    lifecycle.wait_healthy(domain, ok_codes=tuple(meta["HEALTH_OK"]), path=meta["HEALTH_PATH"],
-                           deploy_timeout=meta["DEPLOY_TIMEOUT"], http_timeout=meta["HTTP_TIMEOUT"])
+    lifecycle.wait_healthy(
+        domain,
+        ok_codes=tuple(meta["HEALTH_OK"]),
+        path=meta["HEALTH_PATH"],
+        deploy_timeout=meta["DEPLOY_TIMEOUT"],
+        http_timeout=meta["HTTP_TIMEOUT"],
+    )
 
     # re-auth (token from the old instance is fine, but get a fresh one post-upgrade) and verify
     tok2 = kc_admin.admin_token(domain, pw)