fix(ci): make lint + typecheck green on main

[rlemke]

Fixes the two pre-existing CI failures on main (they predate the thesis-docs PR #21 — that PR was docs-only and did not introduce them).

lint (ruff format --check / ruff check)

• ruff format reformats 23 files left untouched by the earlier relative-scoping / BaseRunner work.
• ruff check: one unused os import (docker/bake-domains.py), one import-sort (tests/runtime/test_relative_scoping.py), two C416 list-comprehensions (tests/test_relative_scope_migrator.py).

typecheck (mypy facetwork/, 8 errors in 5 files)

• BaseRunnerConfig attrs (5 errors) — BaseRunner declares _config: BaseRunnerConfig, which subclasses inherit, so mypy didn't see RunnerConfig.http_port / http_max_port_attempts / shutdown_timeout_ms and RegistryRunnerConfig.registry_refresh_interval_ms. Fixed by re-declaring the narrowed _config type in each subclass. These exist at runtime (the instance is the subclass) — a typing gap, not a runtime bug.
• evaluator._find_statement_body — widened return to dict | list | None; it already returns the chained co-clause list, and callers take Any.
• dashboard/auth.py — narrow presented with is not None for hmac.compare_digest (outcome-equivalent to the old bool(...) guard).
• relative_scope_migrator.py — annotate _current_block_steps: set[str].

Verification

• mypy facetwork/: 0 errors (157 files).
• ruff format --check + ruff check: clean.
• Touched-path tests green: 24 (migrator / scoping / auth) + 437 (runtime evaluator / runner / registry).

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request primarily focuses on code formatting, style cleanups, and minor type annotation improvements across various files, such as narrowing the _config type in runner services and updating the return type of _find_statement_body. It also refines token validation in the authentication middleware by explicitly checking for None. The review feedback correctly points out an opportunity to improve file handling in tests/test_relative_scope_migrator.py by using a with statement and specifying an explicit encoding to prevent resource leaks and platform-dependent decoding errors.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Opening a file using open() without a with statement leaves the file descriptor open until garbage collection, which can cause resource leaks. Additionally, reading files without specifying an explicit encoding (such as encoding='utf-8') can lead to platform-dependent UnicodeDecodeError issues (e.g., on Windows systems where the default encoding might not be UTF-8). Using a with statement and specifying the encoding is safer and more robust.

        errs = list(validate(parse(res.source), relative_scoping=True).errors)\n        with open(matches[0], encoding="utf-8") as f:\n            base = list(validate(parse(f.read()), relative_scoping=False).errors)