lint: ruff format + one auto-fix so the push self-test is green again

`scripts/lint.sh --fix` from the pinned lint devshell: 90 Python files
reformatted (ruff format, mechanical) and one C420 (dict comprehension →
dict.fromkeys) in tests/unit/test_f211_sso_skip.py. The push self-test had
been failing at the lint stage since build 1313 (2026-08-31) on exactly
these files; nothing else changed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

tests/concurrency/test_janitor.py

@@ -78,9 +78,9 @@ def test_7_new_run_blocks_until_reap_finishes(lock_dir, pool, monkeypatch):
     line = wait_marker(state["acquirer_out"], "ACQUIRED", timeout=15)
     assert line, "new run never acquired after the reap"
     acquired_ts = float(line.split()[1])
-    assert (
-        acquired_ts >= state["teardown_end"]
-    ), f"new run acquired at {acquired_ts} BEFORE the reap finished at {state['teardown_end']}"
+    assert acquired_ts >= state["teardown_end"], (
+        f"new run acquired at {acquired_ts} BEFORE the reap finished at {state['teardown_end']}"
+    )
     # The new run must hold a lock the next probe can SEE (fresh inode at the path).
     assert lock_state(DOMAIN) == "held"
 
@@ -160,17 +160,17 @@ def test_11_warm_canonical_names_never_probed(lock_dir, monkeypatch):
     monkeypatch.setattr(
         lifecycle,
         "_docker_names",
-        lambda kind, stack: ["warm-keycloak_ci_commoninternet_net_app"]
-        if kind == "service"
-        else [],
+        lambda kind, stack: (
+            ["warm-keycloak_ci_commoninternet_net_app"] if kind == "service" else []
+        ),
     )
     monkeypatch.setattr(lifecycle, "teardown_app", lambda d, verify=True: calls.append(d))
     lifecycle.janitor()
     assert calls == []
     lockdir = os.environ["CCCI_APP_LOCK_DIR"]
-    assert [
-        f for f in os.listdir(lockdir) if f.startswith("cc-ci-app-")
-    ] == [], "janitor must not create lockfiles for non-run-app names"
+    assert [f for f in os.listdir(lockdir) if f.startswith("cc-ci-app-")] == [], (
+        "janitor must not create lockfiles for non-run-app names"
+    )
 
 
 def test_12_degrades_safely_on_bad_lockfile_and_missing_dir(lock_dir, monkeypatch, capsys):