style(step7): the gate's own source passes its own repository's linter

Three ruff findings, all mine: an unsorted import block, one over-long line
inside the witness source, and an unpacked name a control never reads.

The long line is inside WITNESS_SOURCE, so wrapping it edits the script the gate
runs against the target tree's tools. Hoisting the identity into a local changes
nothing it does, and the controls and probes were re-run to say so rather than
assumed: 15 merge gate controls pass, host qualification 26/26, and the three
real merge probes still come back 0 / 1 / 1 with the same predicates.

This is a lint pass only. No predicate, no attack and no message moved, and
30d2f32 is untouched.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018xhcg5opoFbSTdYHpkSXCh

Author: claude

scripts/step7/mergegate.py

@@ -30,7 +30,6 @@
 from __future__ import annotations
 
 import argparse
-
 import json
 import re
 import subprocess
@@ -154,9 +153,11 @@ def w(name, doc):
 CAND = b"candidate bytes"
 cand = tmp / "cand.bin"; cand.write_bytes(CAND)
 qpath = w("qual.json", QUAL)
+IDENT = QUAL["environment_identity_sha256"]
 stratum_block = lambda m, extra: {"qualification_sha256": hq.sha256_file(qpath),
-                                  "environment_id": "env-1", "host_fingerprint": "sha256:abc",
-                                  "environment_identity_sha256": QUAL["environment_identity_sha256"],
+                                  "environment_id": "env-1",
+                                  "host_fingerprint": "sha256:abc",
+                                  "environment_identity_sha256": IDENT,
                                   "candidate_sha256": hq.sha256_bytes(CAND),
                                   "candidate_bytes": len(CAND), "memory_metric": m, **extra}
 BINDING = {"kind": eb.BINDING_SCHEMA, "schema": 1,

tests/test_step7_mergegate.py

@@ -245,7 +245,7 @@ def control_complete_tree() -> None:
 
 def control_missing_instrument() -> None:
     with tempfile.TemporaryDirectory() as raw:
-        repo, commit = world(Path(raw))
+        repo, _commit = world(Path(raw))
         # the instrument moves after T0 named it — the exact intermediate state a
         # stray merge produces when the repair PR is not in yet
         drifted = commit_tree(repo, {eb.INSTRUMENT_SOURCES[0]: "print('older')" + NL})