[lint] ruff sweep + enforce; stop ignoring F821 in CI

[cursor]

Owner squad: @THOClabs/release-engineering · Priority: P2 · Area: lint

Problem

ruff check services/ voice/ nightwatch/ (configured ruleset) reports 2,675 findings (1,818 auto-fixable). ruff format --check would reformat 72 of 97 files. The CI lint step additionally ignores F821/F401/F841, which is exactly what hides the undefined-name bugs.

Top rules: UP045 (922), UP006 (554), F821 (191), PLC0415 (164), UP035 (133), I001 (93), F401 (82).

Acceptance criteria

• One-time ruff check --fix + ruff format sweep (mechanical, reviewed in a focused PR).
• Stop ignoring F821 in CI; keep any deliberate ignores narrowly scoped and justified.
• Lint + format-check enforced as blocking (depends on the CI-gating issue).

Evidence

docs/reviews/2026-06-23-holistic-review.md §5.