lint: ruff format + one auto-fix so the push self-test is green again

`scripts/lint.sh --fix` from the pinned lint devshell: 90 Python files
reformatted (ruff format, mechanical) and one C420 (dict comprehension →
dict.fromkeys) in tests/unit/test_f211_sso_skip.py. The push self-test had
been failing at the lint stage since build 1313 (2026-08-31) on exactly
these files; nothing else changed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

tests/gitea/custom/test_lfs_roundtrip.py

@@ -145,9 +145,9 @@ def test_lfs_roundtrip(live_app):
             text=True,
             env={**os.environ, **git_env},
         )
-        assert (
-            "testblob.bin" in lfs_ls.stdout
-        ), f"testblob.bin not in git-lfs ls-files: {lfs_ls.stdout}"
+        assert "testblob.bin" in lfs_ls.stdout, (
+            f"testblob.bin not in git-lfs ls-files: {lfs_ls.stdout}"
+        )
 
         # 6. Download in a FRESH clone (proves the LFS server stores and serves the object)
         fresh_dir = tempfile.mkdtemp(prefix="ccci-gitea-lfs-dl-")
@@ -158,9 +158,9 @@ def test_lfs_roundtrip(live_app):
             with open(fetched_path, "rb") as f:
                 fetched = f.read()
             fetched_sha256 = hashlib.sha256(fetched).hexdigest()
-            assert (
-                fetched_sha256 == expected_sha256
-            ), f"LFS round-trip OID mismatch: expected {expected_oid}, got sha256:{fetched_sha256}"
+            assert fetched_sha256 == expected_sha256, (
+                f"LFS round-trip OID mismatch: expected {expected_oid}, got sha256:{fetched_sha256}"
+            )
         finally:
             shutil.rmtree(fresh_dir, ignore_errors=True)
 
@@ -171,9 +171,9 @@ def test_lfs_roundtrip(live_app):
             ["sh", "-c", "grep -E '^LFS_JWT_SECRET' /etc/gitea/app.ini || echo NOT_FOUND"],
             timeout=30,
         ).strip()
-        assert (
-            current_jwt and "NOT_FOUND" not in current_jwt
-        ), "Could not read LFS_JWT_SECRET from /etc/gitea/app.ini before restart"
+        assert current_jwt and "NOT_FOUND" not in current_jwt, (
+            "Could not read LFS_JWT_SECRET from /etc/gitea/app.ini before restart"
+        )
 
         # Restart the gitea container
         lifecycle.exec_in_app(live_app, ["true"], timeout=5)  # no-op to confirm exec works
@@ -213,9 +213,9 @@ def test_lfs_roundtrip(live_app):
             assert os.path.exists(pr_blob), "testblob.bin not fetched in post-restart clone"
             with open(pr_blob, "rb") as f:
                 pr_data = f.read()
-            assert (
-                hashlib.sha256(pr_data).hexdigest() == expected_sha256
-            ), "LFS object corrupted after restart — JWT secret may have changed"
+            assert hashlib.sha256(pr_data).hexdigest() == expected_sha256, (
+                "LFS object corrupted after restart — JWT secret may have changed"
+            )
         finally:
             shutil.rmtree(post_restart_dir, ignore_errors=True)
 

tests/gitea/ops.py

@@ -220,7 +220,7 @@ def pre_restore(ctx):
     generic.assert_serving(ctx.domain, ctx.meta)
     ok = _delete_marker_repo(ctx.domain, user, password)
     assert ok, f"pre_restore: could not delete {_MARKER_REPO} repo on {ctx.domain}"
-    assert not marker_repo_exists(
-        ctx.domain, user, password
-    ), f"pre_restore: {_MARKER_REPO} still present after delete — divergence did not take"
+    assert not marker_repo_exists(ctx.domain, user, password), (
+        f"pre_restore: {_MARKER_REPO} still present after delete — divergence did not take"
+    )
     print(f"  gitea ops: {_MARKER_REPO!r} deleted (diverged from backup state)", flush=True)

tests/gitea/test_backup.py

@@ -22,6 +22,6 @@ def test_backup_captures_marker_repo(live_app, meta):
     # backupbot cycles the gitea container during backup — wait for it to be back up.
     generic.assert_serving(live_app, meta)
     user, password = admin_creds(live_app)
-    assert marker_repo_exists(
-        live_app, user, password
-    ), f"{live_app}: ci-marker repo is not present at backup time (backup would capture empty state)"
+    assert marker_repo_exists(live_app, user, password), (
+        f"{live_app}: ci-marker repo is not present at backup time (backup would capture empty state)"
+    )

tests/gitea/test_install.py

@@ -65,8 +65,8 @@ def test_install_gitea(live_app, meta):
             )
             page.wait_for_selector("input#user_name", timeout=20_000)
             content = page.content()
-            assert (
-                "gitea" in content.lower() or "sign in" in content.lower()
-            ), "Sign-in page did not render expected gitea content"
+            assert "gitea" in content.lower() or "sign in" in content.lower(), (
+                "Sign-in page did not render expected gitea content"
+            )
         finally:
             browser.close()

tests/gitea/test_upgrade.py

@@ -20,6 +20,6 @@ def test_upgrade_preserves_marker_repo(live_app, meta):
     """The ci-marker repo survived the upgrade to the PR head (data continuity)."""
     generic.assert_serving(live_app, meta)
     user, password = admin_creds(live_app)
-    assert marker_repo_exists(
-        live_app, user, password
-    ), f"{live_app}: ci-marker repo did not survive the upgrade (sqlite3 data lost)"
+    assert marker_repo_exists(live_app, user, password), (
+        f"{live_app}: ci-marker repo did not survive the upgrade (sqlite3 data lost)"
+    )