[Quality] Check in a narrow, test-aware Qlty baseline #133

Problem

Qlty Cloud currently applies production Bandit policy to tests and the repository has no checked-in reproducible configuration. This inflated PR #131 with dozens of ordinary pytest assert and synthetic temporary-path findings, obscuring real contract defects.

Scope

• Check in the minimum reproducible Qlty configuration.
• Pin or document the plugins actually used by the required check.
• Treat python/tests/** as test code.
• Narrowly exclude/configure Bandit B101 for pytest assertions.
• Narrowly disposition B108 for synthetic test fixtures without weakening production analysis.
• Document the local command that reproduces the cloud check.
• Keep production Python analysis enabled.

Explicit non-goals

• No new analyzer family.
• No broad codebase autofix.
• No refactor of production or test code merely to satisfy a mismatched rule.
• No duplicate Rust/Python native test execution.
• No change to coverage policy or CI topology.

Acceptance criteria

• A contributor can reproduce the Qlty result locally from the repository.
• Ordinary pytest assertions and synthetic fixture paths are not blocking findings.
• A deliberate production B101/B108 fixture remains detectable.
• The required Qlty check becomes signal-bearing.
• Native repository gates remain unchanged and green.

Relationships

• Stabilization parent: Epic: Phase 1 — Claude Code hook-based enforcement on writ #124
• Sequenced before final review of: [Safety] Exact-base worktree creation so every subagent shares a verified identity #126 / PR fix(worktree): enforce exact-base creation identity #131

Planning synthesis: OpenAI Codex, 2026-08-31.