ci2: fix worker F821 NameError, mark harness2 sha1 non-security, rename E741 var

- worker._tenant_dirs: playwright refresh log used undefined 'task';
  use the method argument project_id (ruff F821, real bug: NameError
  aborted tenant seeding when a playwright script was refreshed).
  Regression: cloud/tests/test_worker_playwright_seed_f821.py (2 tests;
  pre-fix run reproduces NameError at worker.py:2780).
- harness2.assign_ids: hashlib.sha1(..., usedforsecurity=False) -- the
  digest is only a deterministic shuffle seed, not a security use;
  digest value unchanged, bandit B324 no longer fires (High 5 -> 4).
- harness2.select_final: rename ambiguous loop var 'l' to 'lab'
  (ruff E741, behaviour-invariant).
- Deliberately NOT changed: host.py shell=True x4 (see PR body -- all
  four are intentional shell commands, changing semantics is unsafe),
  remaining ruff 109 / mypy 24, workflow thresholds (75% coverage
  gate unchanged; no gate was relaxed or removed).

cloud/worker.py

@@ -2776,9 +2776,13 @@ class Worker:
                     "/var/lib/codex-app-server/codex-home/"
                     "playwright_mcp.py"])
             if _seeded.get("script_refreshed"):
+                # _tenant_dirs 只收 project_id 参数，作用域里没有 task：
+                # 此前写 task.get("project_id") 在脚本刷新时抛 NameError，
+                # 中断整个租户播种（ruff F821，回归见
+                # test_worker_playwright_seed_f821）。
                 self.logger.info(
                     "playwright MCP scripts refreshed for project %s: %s",
-                    task.get("project_id"),
+                    project_id,
                     ",".join(_seeded["script_refreshed"]))
             if _seeded.get("script_skipped_modified"):
                 self.logger.warning(