test: close unclosed file handles in tests (Path read/write)

Replace bare open().read()/write() in tests with Path.read_text/
write_text (or json.loads over read_text); the five remaining
open(...).close() empty-file creations become Path.write_text('').
No assertion, predicate, or production code changed; no behaviour
change beyond closing the handle deterministically.

Long-function splits and server.py module split intentionally not
included: the longest functions (_dispatch, _create_task,
_dispatch_project, ~375-395 lines in a 10430-line server.py) are
central routing/creation paths, and splitting them is not low-risk;
see PR body.

cloud/tests/test_websearch_worker.py

@@ -29,13 +29,13 @@ class WorkerWebsearchTestCase(unittest.TestCase):
         init_db(self.db_path)
         self.template_home = os.path.join(self.tmp.name, "tpl-home")
         os.makedirs(self.template_home)
-        open(os.path.join(self.template_home, "config.toml"),
-             "w").write('[model_provider.xcmapi]\n'
-                         'base_url="https://xcmapi.org/v1"\n')
+        Path(os.path.join(self.template_home, "config.toml")).write_text(
+            '[model_provider.xcmapi]\n'
+            'base_url="https://xcmapi.org/v1"\n', encoding="utf-8")
         self.template_repo = os.path.join(self.tmp.name, "tpl-repo")
         os.makedirs(os.path.join(self.template_repo, ".git"))
-        open(os.path.join(self.template_repo, "sample.py"),
-             "w").write("def add(a, b):\n    return a + b\n")
+        Path(os.path.join(self.template_repo, "sample.py")).write_text(
+            "def add(a, b):\n    return a + b\n", encoding="utf-8")
 
     def tearDown(self):
         self.tmp.cleanup()
@@ -53,8 +53,8 @@ class WorkerWebsearchTestCase(unittest.TestCase):
         worker = self._worker()
         self.assertFalse(worker.websearch_mcp)
         dirs = worker._tenant_dirs("projA")
-        config = open(os.path.join(dirs["codex_home"],
-                                   "config.toml")).read()
+        config = Path(os.path.join(dirs["codex_home"],
+                                   "config.toml")).read_text(encoding="utf-8")
         self.assertNotIn("[mcp_servers.websearch]", config)
         self.assertFalse(os.path.exists(
             os.path.join(dirs["codex_home"], "websearch_mcp.py")))
@@ -63,7 +63,7 @@ class WorkerWebsearchTestCase(unittest.TestCase):
         worker = self._worker(websearch_mcp=True)
         dirs = worker._tenant_dirs("projA")
         home = dirs["codex_home"]
-        config = open(os.path.join(home, "config.toml")).read()
+        config = Path(os.path.join(home, "config.toml")).read_text(encoding="utf-8")
         self.assertIn("[mcp_servers.websearch]", config)
         # Container path, not the host temp path: this config is
         # read inside the task container, where the tenant home is
@@ -76,7 +76,7 @@ class WorkerWebsearchTestCase(unittest.TestCase):
         self.assertTrue(os.path.exists(
             os.path.join(home, "websearch_mcp.py")))
         # The copied MCP script is the real one (not a stub).
-        script = open(os.path.join(home, "websearch_mcp.py")).read()
+        script = Path(os.path.join(home, "websearch_mcp.py")).read_text(encoding="utf-8")
         self.assertIn("web_search", script)
         self.assertIn("web_fetch", script)
 
@@ -85,18 +85,18 @@ class WorkerWebsearchTestCase(unittest.TestCase):
         dirs = worker._tenant_dirs("projA")
         config_path = os.path.join(dirs["codex_home"], "config.toml")
         self.assertNotIn("[mcp_servers.websearch]",
-                         open(config_path).read())
+                         Path(config_path).read_text(encoding="utf-8"))
         # Flag flips on later (deploy enables it): next task's
         # _tenant_dirs must merge, not require a new project.
         worker2 = self._worker(websearch_mcp=True)
         worker2._tenant_dirs("projA")
-        config = open(config_path).read()
+        config = Path(config_path).read_text(encoding="utf-8")
         self.assertIn("[mcp_servers.websearch]", config)
         self.assertIn("xcmapi.org", config)
         self.assertEqual(config.count("[mcp_servers.websearch]"), 1)
         # Third call stays idempotent.
         worker2._tenant_dirs("projA")
-        config = open(config_path).read()
+        config = Path(config_path).read_text(encoding="utf-8")
         self.assertEqual(config.count("[mcp_servers.websearch]"), 1)
 
 
@@ -152,8 +152,8 @@ class DockerEnvTestCase(unittest.TestCase):
 
 class EgressFilterTestCase(unittest.TestCase):
     def test_search_domains_present_in_basic_form(self):
-        lines = open(REPO_ROOT / "deploy" / "egress" /
-                     "tinyproxy-filter").read().splitlines()
+        lines = (REPO_ROOT / "deploy" / "egress" /
+                 "tinyproxy-filter").read_text(encoding="utf-8").splitlines()
         entries = [ln for ln in lines
                    if ln and not ln.startswith("#")]
         # No extended-regex syntax in any entry: + ? | and bare