Enable ruff security, logging and debugging rules (S, T20, LOG, G, DTZ, ERA, TD, FIX, EXE)

[anth-volk]

Fixes #3914

Also fixes #3909: the country validator's print("Validating country") is removed.

Summary

Phase 1 step 1.8, group 6: security, logging and debugging leftovers. Stacked on #3913.

• Rules: select gains S, T20, LOG, G, DTZ, ERA, TD, FIX and EXE. All 262 findings at the base are fixed or kept with an inline reason, one commit per family.
• Behaviour changes (three kinds, all deliberate):
  • Debug prints removed (T201): the country validator (validate_country prints "Validating country" on every request #3909), plus the create, get and update prints in the report output and simulation routes. The two update prints become logger.debug calls on a module logger, because their ids come from the request body.
  • Logger name (LOG015): the household calculation routes log their three errors on a module logger instead of the root logger. The message text is unchanged, and production records still reach the root observability handler.
  • Nothing else: error responses, message text and published schemas are unchanged.
• Asserts outside tests (S101, 10): each type-narrowing assert in the v2 household, policy and user-household services, and two in the rules tool, becomes an explicit check that raises TypeError. None runs inside a Pydantic validator, and nothing catches AssertionError. Every check was already guaranteed by an earlier one, so none is expected to fire; the v2 routes and the mirror paths treat either type the same way. No production command runs Python with -O, so these asserts were live.
• Prints in commands (T201): command-line scripts keep their output. Short ones carry an inline reason; capture_migration_baseline.py, smoke_test_local_boot.py and the rules tool's CLI route output through one _report helper. Application code keeps the api.py startup timings, the gateway-auth warning on stderr and the JSON evidence of the migration qualification commands.
• Datetimes (DTZ, 21): no value switches between naive and aware. The catalog extraction builds its aware UTC value directly; the other 20 stay naive with a reason (naive database columns, the local calendar year, calendar-day review dates in the rules tool, and test values for those).
• Security (S): no vulnerability found.
  • Fixed: hashlib.sha1(..., usedforsecurity=False) (same digest), and the GPT-4 experiment parses embeddings with ast.literal_eval instead of eval.
  • Kept with a reason: fake secrets in tests (now mostly module constants with one suppression each), environment-variable and Secret Manager names, tests running this repository's scripts and git, fixed https and loopback URLs, table names from a fixed tuple, a seeded load-test mix, and the experiment's requests calls, where a timeout would change behaviour.
  • S110: each try/except/pass already carried a reasoned BLE001 suppression from group 5, which now lists S110 too.
• Leftovers: 32 lines of commented-out code are deleted (29 in tests/to_refactor/python/test_policy.py). The two TODOs become plain notes; the user-profile one keeps its link to Utilize a technology like Marshmallow to validate inbound requests #2054 and says it was closed. Six Python scripts with a shebang and a __main__ entry point are now executable.
• Registry: api.quality.ruff-lint now lists the nine families. The shared rules tool changed (explicit checks and reasoned suppressions), so its hash is now 1c4bbb2a93f8; sim takes the same copy in Enable ruff security, logging and debugging rules (S, T20, LOG, G, DTZ, ERA, TD, FIX, EXE) policyengine-sim-api#785.

Testing

• pytest tests/unit tests/contract, to_refactor and the dedupe integration test (the make test set): 2,420 passed, the same as the base.
• make typecheck-v2 is clean. mypy on the 78 changed files outside that gate gives the same output as the base.
• ruff check and ruff format --check (0.15.12) are clean repo-wide.
• Every Pydantic model schema (230 models, 100 adapters), the FastAPI OpenAPI with every native router enabled, the /v2/openapi.json preview and the legacy spec are byte-identical to the base.
• The quality guards, the rules guard and the rules tool unittest (75 tests) pass.
• CI/CD: no workflow changed. Four .github scripts changed only in comments, output helpers or file mode, and the environment variables they read are unchanged.
• CI: this PR is above the bottom of its stack, so it runs only CI complete, which fails and says why (step 0.7, Make CI enforcement trustworthy before the rules registry #3887). Its full run starts once the PRs below it merge.

🤖 Generated with Claude Code