lint: ruff format + one auto-fix so the push self-test is green again

`scripts/lint.sh --fix` from the pinned lint devshell: 90 Python files
reformatted (ruff format, mechanical) and one C420 (dict comprehension →
dict.fromkeys) in tests/unit/test_f211_sso_skip.py. The push self-test had
been failing at the lint stage since build 1313 (2026-08-31) on exactly
these files; nothing else changed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

tests/concurrency/test_janitor.py

@@ -78,9 +78,9 @@ def test_7_new_run_blocks_until_reap_finishes(lock_dir, pool, monkeypatch):
     line = wait_marker(state["acquirer_out"], "ACQUIRED", timeout=15)
     assert line, "new run never acquired after the reap"
     acquired_ts = float(line.split()[1])
-    assert (
-        acquired_ts >= state["teardown_end"]
-    ), f"new run acquired at {acquired_ts} BEFORE the reap finished at {state['teardown_end']}"
+    assert acquired_ts >= state["teardown_end"], (
+        f"new run acquired at {acquired_ts} BEFORE the reap finished at {state['teardown_end']}"
+    )
     # The new run must hold a lock the next probe can SEE (fresh inode at the path).
     assert lock_state(DOMAIN) == "held"
 
@@ -160,17 +160,17 @@ def test_11_warm_canonical_names_never_probed(lock_dir, monkeypatch):
     monkeypatch.setattr(
         lifecycle,
         "_docker_names",
-        lambda kind, stack: ["warm-keycloak_ci_commoninternet_net_app"]
-        if kind == "service"
-        else [],
+        lambda kind, stack: (
+            ["warm-keycloak_ci_commoninternet_net_app"] if kind == "service" else []
+        ),
     )
     monkeypatch.setattr(lifecycle, "teardown_app", lambda d, verify=True: calls.append(d))
     lifecycle.janitor()
     assert calls == []
     lockdir = os.environ["CCCI_APP_LOCK_DIR"]
-    assert [
-        f for f in os.listdir(lockdir) if f.startswith("cc-ci-app-")
-    ] == [], "janitor must not create lockfiles for non-run-app names"
+    assert [f for f in os.listdir(lockdir) if f.startswith("cc-ci-app-")] == [], (
+        "janitor must not create lockfiles for non-run-app names"
+    )
 
 
 def test_12_degrades_safely_on_bad_lockfile_and_missing_dir(lock_dir, monkeypatch, capsys):

tests/concurrency/test_locks.py

@@ -61,9 +61,9 @@ def test_3_lock_fd_not_inherited_by_children(lock_dir, pool):
     p.kill()
     p.wait(timeout=10)
     assert os.path.exists(f"/proc/{child_pid}"), "child should outlive the holder"
-    assert (
-        wait_lock_state(DOMAIN, "free") == "free"
-    ), "lock must release on holder death even with a live child (PEP 446 non-inheritable fd)"
+    assert wait_lock_state(DOMAIN, "free") == "free", (
+        "lock must release on holder death even with a live child (PEP 446 non-inheritable fd)"
+    )
 
 
 def test_4_second_acquire_blocks_until_first_exits(lock_dir, pool):

tests/concurrency/test_run_state.py

@@ -64,9 +64,9 @@ def test_20c_same_domain_runs_each_keep_their_own_count(tmp_path, lock_dir, pool
     pa.wait(timeout=15)
 
     line_b = wait_marker(out_b, "COUNT")
-    assert (
-        line_b is not None and line_b.strip() == "COUNT 1"
-    ), line_b  # B's file survived A's remove
+    assert line_b is not None and line_b.strip() == "COUNT 1", (
+        line_b
+    )  # B's file survived A's remove
     pb.wait(timeout=15)