style: repo-wide lint pass — make the lint gate green again

Push builds have been RED on the lint step since ~build 209 from accumulated
formatting drift. This is the mechanical cleanup: ruff format + ruff --fix
(UP038 isinstance unions, SIM105 contextlib.suppress, UP031 f-strings, SIM115
tempfile context manager), shfmt -i 2 -ci, nixpkgs-fmt/statix/deadnix (merged
attrsets, dropped unused lib args), yamllint, and shell quoting fixes in
tests/lasuite-docs/setup_custom_tests.sh. No behaviour changes intended;
lint: PASS, unit tests: 138 passed.

tests/unit/test_f211_sso_skip.py

@@ -20,9 +20,9 @@ import sys
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
 import run_recipe_ci  # noqa: E402
 
-
 # ---- 1. the pure gate predicate ----
 
+
 def test_sso_dep_unverified_true_when_declared_notready_and_skipped():
     """declares DEPS + deps not ready + ≥1 requires_deps test skipped → run must FAIL (F2-11)."""
     assert run_recipe_ci.sso_dep_unverified(["keycloak"], deps_ready=False, requires_deps_skipped=1)
@@ -31,7 +31,9 @@ def test_sso_dep_unverified_true_when_declared_notready_and_skipped():
 
 def test_sso_dep_unverified_false_when_deps_ready():
     """deps ready (setup_custom_tests succeeded) → SSO tests actually ran → not a failure."""
-    assert not run_recipe_ci.sso_dep_unverified(["keycloak"], deps_ready=True, requires_deps_skipped=0)
+    assert not run_recipe_ci.sso_dep_unverified(
+        ["keycloak"], deps_ready=True, requires_deps_skipped=0
+    )
 
 
 def test_sso_dep_unverified_false_when_no_deps_declared():
@@ -43,11 +45,14 @@ def test_sso_dep_unverified_false_when_no_deps_declared():
 def test_sso_dep_unverified_false_when_nothing_skipped():
     """Deps declared + not ready but ZERO requires_deps tests skipped → don't false-fail
     (the recipe has no SSO-marked tests to have been masked)."""
-    assert not run_recipe_ci.sso_dep_unverified(["keycloak"], deps_ready=False, requires_deps_skipped=0)
+    assert not run_recipe_ci.sso_dep_unverified(
+        ["keycloak"], deps_ready=False, requires_deps_skipped=0
+    )
 
 
 # ---- 2. conftest skip + record behavior ----
 
+
 def _load_conftest():
     """Load tests/conftest.py under a private module name (avoid clashing with pytest's own
     loaded `conftest`), so we can call pytest_collection_modifyitems directly with fakes."""
@@ -95,7 +100,9 @@ def test_conftest_appends_across_invocations(tmp_path, monkeypatch):
     monkeypatch.setenv("CCCI_DEPS_SKIP_REPORT", str(report))
 
     conftest.pytest_collection_modifyitems(None, [_FakeItem(["requires_deps"])])
-    conftest.pytest_collection_modifyitems(None, [_FakeItem(["requires_deps"]), _FakeItem(["requires_deps"])])
+    conftest.pytest_collection_modifyitems(
+        None, [_FakeItem(["requires_deps"]), _FakeItem(["requires_deps"])]
+    )
 
     total = sum(int(x) for x in report.read_text().split())
     assert total == 3