chore(lint): settle the lint fallout of the swarm-nfs merge

Mark the merged best-effort '|| true' sites (guide EXIT trap, baseline
fetch fallback) with shell-or-true nocheck reasons, parenthesize the
implicitly concatenated message strings ISC004 enforces since the ruff
0.16 pin, and drop the regex narration comments the comment lint flags
on the now-changed test files.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/github/guide/host_deploy.sh

@@ -42,7 +42,7 @@ CID="$(docker run -d --privileged --cgroupns=host \
 	--entrypoint /sbin/init \
 	"${BOOT_IMAGE}")"
 # shellcheck disable=SC2154
-trap 'rc=$?; if [ "${rc}" -ne 0 ]; then INFINITO_RESCUE_DIAGNOSTICS_DIR="${INFINITO_RESCUE_DIAGNOSTICS_BASE}/${GUIDE_ROLE}" python3 utils/diagnostics/container.py "${GUIDE_ROLE}" "guide host boot failure" || true; fi; docker rm -f "${CID}" >/dev/null 2>&1 || true; docker rmi -f "${BOOT_IMAGE}" >/dev/null 2>&1 || true' EXIT
+trap 'rc=$?; if [ "${rc}" -ne 0 ]; then INFINITO_RESCUE_DIAGNOSTICS_DIR="${INFINITO_RESCUE_DIAGNOSTICS_BASE}/${GUIDE_ROLE}" python3 utils/diagnostics/container.py "${GUIDE_ROLE}" "guide host boot failure" || true; fi; docker rm -f "${CID}" >/dev/null 2>&1 || true; docker rmi -f "${BOOT_IMAGE}" >/dev/null 2>&1 || true' EXIT # nocheck: shell-or-true -- best-effort diagnostics + teardown in the EXIT trap
 
 for _ in $(seq 1 40); do
 	state="$(docker exec "${CID}" systemctl is-system-running 2>/dev/null || true)"

scripts/meta/resolve/diff/new_roles.sh

@@ -9,6 +9,6 @@ REPO_ROOT="$(cd "$SCRIPT_DIR/../../../.." && pwd)"
 cd "$REPO_ROOT"
 
 git fetch --quiet --no-tags --prune --depth=50 origin main >/dev/null 2>&1 ||
-	git fetch --quiet --no-tags --prune origin main >/dev/null 2>&1 || true
+	git fetch --quiet --no-tags --prune origin main >/dev/null 2>&1 || true # nocheck: shell-or-true -- baseline fetch is best-effort; a missing origin/main means "no new roles" by contract
 
 "${PYTHON}" -m cli.meta.roles.applications.new_in_branch origin/main

tests/lint/filesystem/playwright/test_onion_request_timeout.py

@@ -40,14 +40,10 @@ from . import PROJECT_ROOT
 if TYPE_CHECKING:
     from pathlib import Path
 
-# A standalone `request.<method>(` call. The negative lookbehind rejects
-# `page.request.get(` / `ctx.request.get(` (member access) so only the bare
-# `request` fixture is flagged.
 _CALL_RE = re.compile(
     r"(?<![.\w])request\.(?:get|post|put|patch|delete|head|fetch)\s*\("
 )
 _RESOLVE_RE = re.compile(r"\bresolveTimeout\s*\(")
-# `require("./timeouts")` / `require("../timeouts")` — the staged helper.
 _IMPORTS_TIMEOUTS = re.compile(r"""require\(\s*['"][^'"]*\btimeouts['"]\s*\)""")
 _NOCHECK_RE = re.compile(r"#\s*nocheck:\s*onion-request-timeout\b")
 
@@ -123,10 +119,6 @@ def _scan_file(path: Path) -> list[Violation]:
             )
         )
 
-    # A file that uses `resolveTimeout` must import it from the staged helper,
-    # or the spec crashes at runtime (a bad `require` path is invisible to a
-    # syntax check). `./timeouts` from a top-level spec, `../timeouts` from an
-    # `addons/` subdir.
     if _RESOLVE_RE.search(text) and not _IMPORTS_TIMEOUTS.search(text):
         line_no = 1
         for idx, raw in enumerate(lines, 1):
@@ -164,8 +156,10 @@ class TestOnionRequestTimeout(unittest.TestCase):
             for v in all_violations:
                 grouped.setdefault(v.file, []).append(v)
             header = [
-                f"Standalone Playwright `request.*()` without an onion-aware "
-                f"timeout ({len(all_violations)} across {len(grouped)} file(s)):",
+                (
+                    f"Standalone Playwright `request.*()` without an onion-aware "
+                    f"timeout ({len(all_violations)} across {len(grouped)} file(s)):"
+                ),
                 "",
                 "On an onion node the target is a `.onion` reached via Tor; the",
                 "default 30s APIRequestContext timeout is too short for a cold",

tests/lint/filesystem/shell/test_no_or_true.py

@@ -29,7 +29,6 @@ from . import PROJECT_ROOT
 if TYPE_CHECKING:
     from pathlib import Path
 
-# ``... || true`` (also ``|| :``), optionally followed by a comment.
 _OR_TRUE_RE = re.compile(r"\|\|\s*(?:true|:)\s*(?:#|;|$)")
 _NOCHECK_RE = re.compile(r"#\s*nocheck\b")
 
@@ -97,14 +96,18 @@ class TestShellNoOrTrue(unittest.TestCase):
             for v in all_violations:
                 grouped.setdefault(v.file, []).append(v)
             lines = [
-                f"Unmarked `|| true` in .sh "
-                f"({len(all_violations)} violations across "
-                f"{len(grouped)} file(s)):",
+                (
+                    f"Unmarked `|| true` in .sh "
+                    f"({len(all_violations)} violations across "
+                    f"{len(grouped)} file(s)):"
+                ),
                 "",
-                "`cmd || true` discards cmd's exit code, so a future "
-                "regression passes silently. Catch the specific tolerated "
-                "error instead, or suppress per line with "
-                "`# nocheck: shell-or-true -- <reason>`.",
+                (
+                    "`cmd || true` discards cmd's exit code, so a future "
+                    "regression passes silently. Catch the specific tolerated "
+                    "error instead, or suppress per line with "
+                    "`# nocheck: shell-or-true -- <reason>`."
+                ),
                 "",
                 "Offenders:",
             ]