lint: ruff format + one auto-fix so the push self-test is green again

`scripts/lint.sh --fix` from the pinned lint devshell: 90 Python files
reformatted (ruff format, mechanical) and one C420 (dict comprehension →
dict.fromkeys) in tests/unit/test_f211_sso_skip.py. The push self-test had
been failing at the lint stage since build 1313 (2026-08-31) on exactly
these files; nothing else changed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

tests/regression/test_canaries.py

@@ -229,13 +229,13 @@ def _assert_green(rc: int, results: dict | None, canary: dict, note: str) -> Non
     # 1. Harness exit code must be 0 (GREEN).
     assert rc == 0, f"[{canary['id']}] harness returned non-zero rc={rc} — expected GREEN. {note}"
 
-    assert (
-        results is not None
-    ), f"[{canary['id']}] results.json not written — harness may have crashed. {note}"
+    assert results is not None, (
+        f"[{canary['id']}] results.json not written — harness may have crashed. {note}"
+    )
 
     # 2. Install tier must have passed.
     assert results.get("results", {}).get("install") == "pass", (
-        f"[{canary['id']}] install tier did not pass: " f"results={results.get('results')}. {note}"
+        f"[{canary['id']}] install tier did not pass: results={results.get('results')}. {note}"
     )
 
     # 3. No tier may have FAILED (skips are acceptable for recipes without backup or custom tests).
@@ -243,14 +243,14 @@ def _assert_green(rc: int, results: dict | None, canary: dict, note: str) -> Non
     assert not failed_tiers, f"[{canary['id']}] tiers failed: {failed_tiers}. {note}"
 
     # 4. Teardown must be clean (no leftover containers/volumes/secrets).
-    assert (
-        results.get("flags", {}).get("clean_teardown") is True
-    ), f"[{canary['id']}] clean_teardown=False — residual state left on server. {note}"
+    assert results.get("flags", {}).get("clean_teardown") is True, (
+        f"[{canary['id']}] clean_teardown=False — residual state left on server. {note}"
+    )
 
     # 5. No secret values leaked into the results artifact.
-    assert (
-        results.get("flags", {}).get("no_secret_leak") is True
-    ), f"[{canary['id']}] no_secret_leak=False — a secret value appeared in results.json. {note}"
+    assert results.get("flags", {}).get("no_secret_leak") is True, (
+        f"[{canary['id']}] no_secret_leak=False — a secret value appeared in results.json. {note}"
+    )
 
     # 6. Semantic stage assertions — TEETH CHECK.
     # These verify that specific named tests actually ran and passed in the expected stage.