style: repo-wide lint pass — make the lint gate green again

Push builds have been RED on the lint step since ~build 209 from accumulated
formatting drift. This is the mechanical cleanup: ruff format + ruff --fix
(UP038 isinstance unions, SIM105 contextlib.suppress, UP031 f-strings, SIM115
tempfile context manager), shfmt -i 2 -ci, nixpkgs-fmt/statix/deadnix (merged
attrsets, dropped unused lib args), yamllint, and shell quoting fixes in
tests/lasuite-docs/setup_custom_tests.sh. No behaviour changes intended;
lint: PASS, unit tests: 138 passed.

tests/lasuite-docs/functional/test_oidc_login.py

@@ -25,7 +25,8 @@ import urllib.request
 import pytest
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", "runner"))
-from harness import http as harness_http, sso  # noqa: E402
+from harness import http as harness_http  # noqa: E402
+from harness import sso
 
 _CTX = ssl.create_default_context()
 _CTX.check_hostname = False
@@ -61,9 +62,9 @@ def test_oidc_login_via_keycloak(live_app, deps_creds):
     # 302 redirect. Both are valid "auth-required" indicators — accept either, but if a
     # redirect is returned it must point at the dep keycloak realm.
     if status in (301, 302, 303, 307, 308):
-        assert expected_prefix in (redirect or ""), (
-            f"Docs redirected to {redirect!r}, expected to start with {expected_prefix!r}"
-        )
+        assert expected_prefix in (
+            redirect or ""
+        ), f"Docs redirected to {redirect!r}, expected to start with {expected_prefix!r}"
     else:
         assert status in (401, 403), (
             f"GET /api/v1.0/users/me/ unauth: HTTP {status}; expected redirect to keycloak "
@@ -88,6 +89,6 @@ def test_oidc_login_via_keycloak(live_app, deps_creds):
     )
     assert status == 200, f"GET /api/v1.0/users/me/ with token HTTP {status}: {body!r}"
     assert isinstance(body, dict), f"unexpected response: {body!r}"
-    assert body.get("email") == kc["email"], (
-        f"unexpected user email: got {body.get('email')!r}, expected {kc['email']!r}"
-    )
+    assert (
+        body.get("email") == kc["email"]
+    ), f"unexpected user email: got {body.get('email')!r}, expected {kc['email']!r}"