style: repo-wide lint pass — make the lint gate green again

Push builds have been RED on the lint step since ~build 209 from accumulated
formatting drift. This is the mechanical cleanup: ruff format + ruff --fix
(UP038 isinstance unions, SIM105 contextlib.suppress, UP031 f-strings, SIM115
tempfile context manager), shfmt -i 2 -ci, nixpkgs-fmt/statix/deadnix (merged
attrsets, dropped unused lib args), yamllint, and shell quoting fixes in
tests/lasuite-docs/setup_custom_tests.sh. No behaviour changes intended;
lint: PASS, unit tests: 138 passed.

tests/lasuite-drive/functional/test_health_check.py

@@ -25,6 +25,8 @@ def test_lasuite_drive_returns_200(live_app):
     status, _ = harness_http.retry_http_get(
         url, expect_status=(200, 301, 302), max_wait=60, interval=3
     )
-    assert status in (200, 301, 302), (
-        f"lasuite-drive at {url} returned HTTP {status} (expected 200/301/302)"
-    )
+    assert status in (
+        200,
+        301,
+        302,
+    ), f"lasuite-drive at {url} returned HTTP {status} (expected 200/301/302)"

tests/lasuite-drive/functional/test_minio_storage.py

@@ -29,8 +29,8 @@ BUCKET = "drive-media-storage"
 def _mc(domain: str, script: str) -> str:
     """Run an `mc` shell script inside the minio container (root creds from /run/secrets)."""
     prelude = (
-        'set -e; '
-        'U=$(cat /run/secrets/minio_ru); P=$(cat /run/secrets/minio_rp); '
+        "set -e; "
+        "U=$(cat /run/secrets/minio_ru); P=$(cat /run/secrets/minio_rp); "
         'mc alias set ccci http://localhost:9000 "$U" "$P" >/dev/null 2>&1; '
     )
     return lifecycle.exec_in_app(domain, ["sh", "-c", prelude + script], service="minio")
@@ -49,13 +49,13 @@ def test_minio_bucket_present_and_object_roundtrip(live_app):
         domain,
         # upload via stdin; list the object; read it back (tagged); then delete.
         f'printf %s "{marker}" | mc pipe ccci/{BUCKET}/{key} >/dev/null 2>&1; '
-        f'mc ls ccci/{BUCKET}/{key}; '
+        f"mc ls ccci/{BUCKET}/{key}; "
         f'echo "READBACK:$(mc cat ccci/{BUCKET}/{key})"; '
-        f'mc rm ccci/{BUCKET}/{key} >/dev/null 2>&1',
+        f"mc rm ccci/{BUCKET}/{key} >/dev/null 2>&1",
     )
 
     # The object was listed (its key appears) and its content round-tripped intact.
     assert f"{marker}.txt" in out, f"uploaded object not listed in bucket: {out!r}"
-    assert f"READBACK:{marker}" in out, (
-        f"object content did not round-trip through MinIO; got: {out!r}"
-    )
+    assert (
+        f"READBACK:{marker}" in out
+    ), f"object content did not round-trip through MinIO; got: {out!r}"

tests/lasuite-drive/functional/test_oidc_with_keycloak.py

@@ -46,9 +46,9 @@ def test_oidc_password_grant_against_dep_keycloak(live_app, deps_creds):
 
     # Creds shape. WC1: realm is per-run namespaced "<parent>-<6hex>"; client_id stays the parent.
     assert kc["domain"]
-    assert re.fullmatch(r"lasuite-drive-[0-9a-f]{6}", kc["realm"]), (
-        f"realm {kc['realm']!r} not the per-run namespaced form lasuite-drive-<6hex>"
-    )
+    assert re.fullmatch(
+        r"lasuite-drive-[0-9a-f]{6}", kc["realm"]
+    ), f"realm {kc['realm']!r} not the per-run namespaced form lasuite-drive-<6hex>"
     assert kc["client_id"] == "lasuite-drive"
     assert isinstance(kc["client_secret"], str) and len(kc["client_secret"]) >= 16
     assert isinstance(kc["password"], str) and len(kc["password"]) >= 16
@@ -77,16 +77,14 @@ def test_oidc_password_grant_against_dep_keycloak(live_app, deps_creds):
 
     # Password grant → real JWT
     token = sso.oidc_password_grant(creds)
-    assert isinstance(token, str) and token.count(".") == 2, (
-        f"access_token is not a JWT: {token!r}"
-    )
+    assert isinstance(token, str) and token.count(".") == 2, f"access_token is not a JWT: {token!r}"
     payload = json.loads(_b64url_decode(token.split(".")[1]))
     assert payload.get("iss") == expected_iss, f"JWT iss={payload.get('iss')!r} != {expected_iss!r}"
-    assert payload.get("azp") == kc["client_id"], (
-        f"JWT azp={payload.get('azp')!r} != {kc['client_id']!r}"
-    )
+    assert (
+        payload.get("azp") == kc["client_id"]
+    ), f"JWT azp={payload.get('azp')!r} != {kc['client_id']!r}"
     assert payload.get("typ") == "Bearer", f"JWT typ={payload.get('typ')!r} != 'Bearer'"
     exp = payload.get("exp")
-    assert isinstance(exp, int) and exp > time.time(), (
-        f"JWT exp={exp!r} not a future timestamp (now={time.time():.0f})"
-    )
+    assert (
+        isinstance(exp, int) and exp > time.time()
+    ), f"JWT exp={exp!r} not a future timestamp (now={time.time():.0f})"