Merge origin/main into main

Reconcile the staged-projection and Diagnostics feature work with the CI
quality-gate changes from origin/main. The origin side of every conflict was
lint-only, so the feature imports were kept and the ruff fixes re-applied:

- keep the branch's added imports (timefmt, activity_readout, projection
  ladder helpers) and drop the unused ones ruff reported
- restore `noqa: E402` on the post-bootstrap imports in fenris-monitor and
  keep the `noqa: F401` re-exports in the TUI that tests assert on
- make the TUI monitoring-glyph test clock-relative instead of pinned to a
  fixed date

src/fenris/store.py

@@ -7,7 +7,6 @@ This module handles:
 """
 import sqlite3
 from pathlib import Path
-from typing import Optional
 
 
 # Schema version - increment on each migration
@@ -77,7 +76,7 @@ def init_store(store_path: Path) -> sqlite3.Connection:
     if current_version == 0:
         # New database - create schema
         _create_schema(conn)
-        conn.execute(f"PRAGMA user_version={SCHEMA_VERSION}")
+        conn.execute(f"PRAGMA user_version={SCHEMA_VERSION}")  # nosemgrep: sqlalchemy-execute-raw-query, formatted-sql-query -- SCHEMA_VERSION is an int constant; PRAGMA cannot bind parameters
         conn.commit()
     elif current_version > SCHEMA_VERSION:
         # Unknown newer version - refuse
@@ -339,7 +338,7 @@ def _apply_migrations(conn: sqlite3.Connection, current_version: int):
         conn.execute("BEGIN IMMEDIATE")
         try:
             migration(conn)
-            conn.execute(f"PRAGMA user_version={target_version}")
+            conn.execute(f"PRAGMA user_version={target_version}")  # nosemgrep: sqlalchemy-execute-raw-query, formatted-sql-query -- target_version is an int key of the static migrations map; PRAGMA cannot bind parameters
             conn.commit()
         except Exception:
             conn.rollback()
@@ -364,7 +363,7 @@ def _migrate_1_to_2(conn: sqlite3.Connection) -> None:
         ).fetchall()}
         for column in ("unattributed_bytes_written", "unattributed_bytes_read"):
             if column not in cols:
-                conn.execute(
+                conn.execute(  # nosemgrep: sqlalchemy-execute-raw-query, formatted-sql-query -- column comes from a hardcoded tuple; DDL cannot bind identifiers
                     f"ALTER TABLE day_aggregates ADD COLUMN {column} INTEGER DEFAULT 0"
                 )
 
@@ -421,7 +420,7 @@ def _migrate_4_to_5(conn: sqlite3.Connection) -> None:
             ("last_sample_id", "INTEGER"),
         ):
             if column not in local_cols:
-                conn.execute(
+                conn.execute(  # nosemgrep: sqlalchemy-execute-raw-query, formatted-sql-query -- column and declaration come from a hardcoded tuple; DDL cannot bind identifiers
                     f"ALTER TABLE local_days ADD COLUMN {column} {declaration}"
                 )
     _create_local_day_shared_evidence(conn)
@@ -479,7 +478,7 @@ def migrate_to_latest(store_path: Path) -> int:
     # Version 0 means no schema — create fresh (issue #73)
     if current_version == 0:
         _create_schema(conn)
-        conn.execute(f"PRAGMA user_version={SCHEMA_VERSION}")
+        conn.execute(f"PRAGMA user_version={SCHEMA_VERSION}")  # nosemgrep: sqlalchemy-execute-raw-query, formatted-sql-query -- SCHEMA_VERSION is an int constant; PRAGMA cannot bind parameters
         conn.commit()
         conn.close()
         return SCHEMA_VERSION