chore(quality): clear real CodeQL quality-scan findings

[oabolade]

Summary

Triaged all 11 open GitHub Code Quality (CodeQL) rules on main and fixed the small set of genuine findings. Everything else is a framework false positive or an intentional pattern — dismissed on the Code Quality UI, not changed.

Headline: no real bugs. The two Error-level findings are intentional negative tests that call keyword-only APIs positionally under pytest.raises(TypeError) (with # type: ignore[misc]) to enforce the Flag-1 contract — test_emit_approval_record.py:61 and test_hitl.py:361.

Fixed here (real, zero-behavior-change)

• tests/unit/test_trace_hitl.py — drop unused datetime/timezone import + the unused langchain_core = pytest.importorskip(...) binding.
• tests/unit/test_redaction_pii.py — import Any (used in a local annotation; latent F821, harmless only because local annotations aren't evaluated).
• scripts/demo_for_gif.py — f-string without placeholder → plain string.

Left as-is (dismiss on the Code Quality UI — no public API to do it programmatically)

Rule	#	Why it's not a code change
Unused global variable	16	alembic revision/down_revision/branch_labels/depends_on — framework API globals
Wrong args (call / class instantiation)	2	intentional keyword-only negative tests
Except handles BaseException	2	both re-raise — correct
Empty except	2	UUID-parse fallback; asyncio.CancelledError on task cancel — correct
Module imported >once / import+from	6	intentional lazy per-function imports; migration/CLI boilerplate
First param not self	3	deliberate self_inner in nested test classes

Verification

• Full unit suite: 294 passed.
• ruff check . findings 9 → 2 (the 2 remaining are the pre-existing intentional E402 SDK_VERSION re-exports, unrelated).

🤖 Generated with Claude Code