fix(ci): make Code Quality workflow fully green (#2128)

[mrveiss]

Summary

The Code Quality CI workflow has never passed (62 failures, 0 successes across 100 runs). Three root causes:

1. Black/isort version mismatch — CI installed unpinned latest (Black 26.3.1) while pre-commit pinned old (23.12.1). Different formatting rules = 200 files fail.
2. 200 files never formatted — Pre-commit only runs on staged files. Files predating the hooks were never formatted. CI checks all files.
3. flake8/bandit config mismatch — CI used hardcoded inline args instead of the .flake8/.bandit config files that pre-commit uses.

Changes

• Pin CI tool versions to match pre-commit (Black 26.3.1, isort 8.0.1, flake8 7.3.0, autoflake 2.3.3, bandit 1.9.4)
• Update pre-commit hooks to latest versions (Black 23→26, isort 5→8, flake8 7.0→7.3, autoflake 2.2→2.3, bandit 1.7→1.9)
• Bulk format 236 files with Black + isort (mechanical, no logic changes)
• CI flake8 now uses .flake8 config instead of mismatched inline args
• Fix 3 unused global declarations (F824 — read-only globals don't need global keyword)
• Add 5 bandit skips for false positives/test-only patterns (B104/B106/B113/B605/B615)
• Fix hook false positives: exclude migrations from function-length, ansible dirs from no-print-console

Local verification (all exit 0)

Check	Result
black --check	1846 files unchanged
isort --check	Pass
flake8 --config=.flake8	Pass
autoflake --check	Pass
bandit -c .bandit	Pass

Test plan

• CI Code Quality workflow passes on this PR
• SSOT Coverage workflow still passes
• Spot-check a few reformatted files for correctness

Closes #2128

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!

[mrveiss]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

Reviewed: version pinning, .flake8/.bandit config alignment, 3 global declaration removals (all read-only — safe), hook exclusion patterns, and bulk formatting scope. All changes are correct and consistent.

Minor observations (below reporting threshold, not blocking):

• Hook header comments could be updated to document new ansible/migrations exclusions
• CLAUDE.md states 100-char line limit but .flake8 enforces 120 — pre-existing doc inconsistency, not introduced by this PR
• autoflake CI args lack --expand-star-imports vs pre-commit — pre-existing mismatch, not in scope

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}