Housekeeping: dependency bumps, lint debt, finished TODOs, dependabot

[Tomer Glottmann (tomergee)]

Follow-ups from a repo health pass over main at 077ae95, rebased onto 490130e after #80. Four commits, each self-contained.

1. Dependencies

modelcontextprotocol/go-sdk 1.4.1 → 1.8.0, grpc 1.83.2 → 1.84.0, k8s.io/{api,apimachinery} 0.37.0 → 0.37.1. Build, vet and the full suite pass; no code changes were needed.

2. Lint debt the coming gates would surface

• staticcheck ST1005: the three multi-line CLI error strings in cmd/ate-env/manifest.go ended with a period. Dropped; the tests match substrings only.
• ruff for clients/python: a configuration (pyflakes, non-layout pycodestyle, import order, pyupgrade for the 3.10 floor; generated stubs excluded), the one finding it produces fixed, ruff pinned in the dev extra, and CI runs ruff check clients/python after the tests. The nemo-gym integration is left for after integrations/nemo-gym: port to the current client, derive templates from images, run the tests in CI #82 lands, which rewrites its files.

3. Finished TODOs, wording, grpcio floor, dependabot

• env.proto: three of the four TODO(jbd) notes describe done work (data plane in guest.proto, REST lifecycle endpoints gone, docs updated); only ListEnvironments remains. internal/ate/client.go: the two atespace TODOs are done.
• Python stubs regenerated for the proto comment change. The generator is grpcio-tools 1.84, which stamps GRPC_GENERATED_VERSION = 1.84.0 and makes the import-time check require grpcio ≥ 1.84; both Python projects' floors move from 1.83 to 1.84 to match. (This is the check fix(python): soften grpc generated version check in proto stubs #81 tried to soften; the floor is the right lever.)
• docs/release.md: "task-image templates" → "rootfs-image templates".
• .github/dependabot.yml: weekly grouped updates for the Go module, the Python client and the workflow actions. The Substrate module is excluded on purpose: its bumps change the generated API and go through the bump procedure. The nemo-gym integration is not listed: its ate-env-client dependency is a path source Dependabot cannot resolve, and nothing in it is pinned. Each update has a 7-day cooldown, which the organization's zizmor check requires (dependabot-cooldown).

4. ruff pass over the SDK merged in #80

The fleet, driver, runtime, strategies, config and their tests landed after the gate in commit 2 was written and carry 198 findings under it. All mechanical: PEP 585/604 annotations, typing imports moved to collections.abc, unused imports and import order in tests, quoted annotations. Two by hand: backend/mock.py used Any without importing it, and client.py had import collections below a function. 118 tests pass after it.

Testing

go build, go vet, go test ./..., make verify-gofmt verify-boilerplate, staticcheck clean, buf generate no diff, Python client 73 tests, ruff check clean, zizmor clean on the workflows.

Not here

The Substrate bump to today's main (13 commits past the pin; HTTPGetAction is now HttpGetAction) is its own PR next.