lint: fix pre-existing failures so the self-test pipeline passes

Push build #33 (this branch) failed at the lint gate on failures inherited from
main, which block this PR from merging:
- runner/harness/warm.py: ruff format (long regex line — no code change)
- nix/modules/acme-dns.nix: statix W201 'avoid repeated keys' — fold the three
  service definitions (acme-dns, cc-ci-acme-storage-seed,
  cc-ci-acme-traefik-handoff) into one services = { ... } attrset. Pure
  restructure: systemd.services eval of all three units is byte-identical to
  main (nix eval --json diff, all three IDENTICAL).

scripts/lint.sh now: PASS.

runner/harness/warm.py

@@ -41,7 +41,9 @@ _CTX.check_hostname = False
 _CTX.verify_mode = ssl.CERT_NONE
 
 # A cold per-run stack name looks like "<tag>-<6hex>_ci_commoninternet_net_<svc>"; extract the hex.
-_STACK_HEX_RE = re.compile(r"^[a-z0-9]{1,4}-([0-9a-f]{6})_ci_(?:autonomic_zone|commoninternet_net)_")
+_STACK_HEX_RE = re.compile(
+    r"^[a-z0-9]{1,4}-([0-9a-f]{6})_ci_(?:autonomic_zone|commoninternet_net)_"
+)
 
 
 def stable_domain(recipe: str) -> str: