Make canonical-check self-enforcing — add rules + fix the Make target

Part of umbrella #10569 · priority: high · the "self-enforcing" task

Problem

The runner tools/lint/canonical_check.py enforces only one rule
(py-print-smoke). The other canonical disciplines in this umbrella are not
detectable, so drift returns silently. Also, make canonical-audit calls
python (absent here — only python3), so the Make target fails outright.

What to do

• Fix the Make target(s) to invoke python3 (or a resolved interpreter), so
  make canonical-audit runs.
• Add new rules to canonical_check.py (and canonical_check_infra.py where
  relevant), each with fixtures under repo_tests/lint/canonical/fixtures/:
  • py-adhoc-db-engine — create_engine/sessionmaker outside the canonical
    factory (see Umbrella: canonical-debt — converge non-canonical code + make canonical-check self-enforcing #10569 / DB task).
  • py-hardcoded-url — http://localhost|127.0.0.1:PORT literals (allow
    # noqa).
  • fix-suffix-filename — _fix/_v2/_old/_copy-suffixed source files.
  • py-sync-requests-in-async (warn) — blocking requests.* in async defs.
  • py-duplicate-concept (warn) — Enhanced*/Unified* + base pairs.
• Wire the new rules into the pre-commit --files path and the weekly audit
  cron so regressions are blocked/surfaced.
• The runner code must itself follow canonical style (dogfood).

Acceptance criteria

• make canonical-audit runs without a python-not-found error.
• New rules detect the seeded fixtures (positive) and pass clean fixtures
  (negative).
• Rules run in pre-commit (--files) and in the audit (--all).
• Severities set deliberately (BLOCK vs warn); # noqa escape honored.
• Docs/skill note updated to list the new rules.