ci2: fix worker F821 NameError, mark harness2 sha1 non-security, rename E741 var

- worker._tenant_dirs: playwright refresh log used undefined 'task';
  use the method argument project_id (ruff F821, real bug: NameError
  aborted tenant seeding when a playwright script was refreshed).
  Regression: cloud/tests/test_worker_playwright_seed_f821.py (2 tests;
  pre-fix run reproduces NameError at worker.py:2780).
- harness2.assign_ids: hashlib.sha1(..., usedforsecurity=False) -- the
  digest is only a deterministic shuffle seed, not a security use;
  digest value unchanged, bandit B324 no longer fires (High 5 -> 4).
- harness2.select_final: rename ambiguous loop var 'l' to 'lab'
  (ruff E741, behaviour-invariant).
- Deliberately NOT changed: host.py shell=True x4 (see PR body -- all
  four are intentional shell commands, changing semantics is unsafe),
  remaining ruff 109 / mypy 24, workflow thresholds (75% coverage
  gate unchanged; no gate was relaxed or removed).

cloud/harness2.py

@@ -1209,7 +1209,10 @@ def _anon_id(index: int) -> str:
 
 def assign_ids(labels: Sequence[str], *, task_id: str, k: int, mode: str) -> dict[str, str]:
     """匿名 id -> 真实 label：按排序后定种子洗牌，同输入永远同结果。"""
-    seed = int(hashlib.sha1(f"{task_id}|{k}|{mode}".encode()).hexdigest()[:12], 16)
+    # 仅确定性洗牌种子，非安全用途（不防碰撞、不做完整性校验）：
+    # usedforsecurity=False 后 bandit B324 不再误报，且摘要值不变。
+    seed = int(hashlib.sha1(f"{task_id}|{k}|{mode}".encode(),
+                            usedforsecurity=False).hexdigest()[:12], 16)
     ordered = sorted(labels)
     random.Random(seed).shuffle(ordered)
     return {_anon_id(i): lbl for i, lbl in enumerate(ordered)}
@@ -1284,7 +1287,8 @@ def select_final(
         except Exception as exc:
             # 回落：已交付的终版里排第一的那个；连这个都没有才算选失败。
             sel.chosen_label = sorted(pool)[0]
-            sel.chosen_id = next(a for a, l in sel.id_map.items() if l == sel.chosen_label)
+            sel.chosen_id = next(a for a, lab in sel.id_map.items()
+                                 if lab == sel.chosen_label)
             sel.fallback = True
             sel.error = str(exc)[:400]
             sel.ok = True