Sweeps the full backlog of CodeQL `python` alerts on `main` (alerts 396, 401,
402, 408, 411-439). All fixes are surgical and behaviour-preserving — they
make CodeQL's taint and dataflow tracker recognise existing invariants rather
than changing runtime semantics.

py/log-injection (4 alerts)
- `services/api/app/api/v1/endpoints/alerts.py` (#396, #401, #402):
  apply existing `_log_safe` helper to `idempotency_key` and
  `payload.connector_type` before they hit `logger.info` / `logger.exception`.
- `services/api/app/api/v1/endpoints/waitlist.py` (#413): introduce a local
  `_log_safe` and sanitise `previous` + `payload.status` on the
  `waitlist_status_transition` log line. Pydantic already gates these against
  `ALLOWED_WAITLIST_STATUSES`, so this is a no-op for valid input.
- `services/api/app/services/effective_permissions/service.py` (#412):
  scrub CR/LF out of `provider` before the
  "no production snapshot loader wired" warning.

py/uninitialized-local-variable (2 alerts)
- `services/agents/tests/test_graph_freshness.py` (#414, #415):
  add `return` after `pytest.skip()` in two `except ImportError` blocks so
  CodeQL sees every branch terminating.

py/mixed-returns (1 alert)
- `services/agents/tests/test_graph_freshness.py` (#438):
  add explicit `return None` after `pytest.skip()` in `_import_or_skip` so
  every control-flow path ends in an explicit return.

py/side-effect-in-assert (1 alert)
- `services/agents/tests/test_fidelity_harness.py` (#435):
  hoist file open + line count out of the `assert` expression so the
  side-effect doesn't disappear under `python -O`.

py/incomplete-url-substring-sanitization (1 alert)
- `services/teams-bot/tests/test_cards.py` (#411):
  replace `startswith("http://adaptivecards.io/")` with an exact equality
  check against the full canonical `$schema` URL.

py/ineffectual-statement (12 alerts)
- Replace `...` placeholders inside `Protocol` method bodies with explicit
  docstrings so CodeQL doesn't flag the ellipsis as a no-op statement:
  - `services/teams-bot/app/services/aisoc_clients.py` (#418, #419, #420, #421)
  - `services/teams-bot/app/callbacks.py` (#426, #427, #428)
  - `services/slack-bot/app/services/approval_audit.py` (#422)
  - `services/api/app/services/attack_chain.py` (#424, #425)
  - `services/api/app/services/email_approval.py` (#429)
- Bind bare `await task` results to `_` so the value is consumed
  semantically, not discarded:
  - `services/slack-bot/app/services/approval_timeout.py` (#423)
  - `services/slack-bot/tests/test_approval_timeout.py` (#430-#434)

py/unnecessary-lambda (1 alert)
- `services/slack-bot/app/services/approval_audit.py` (#439):
  use `default_factory=time.time` directly instead of wrapping it in a
  lambda.

py/unused-global-variable (3 alerts)
- `services/agents/app/context/bundle.py` (#408) +
  `services/agents/tests/test_context_bundle.py`:
  rename `_LLM_SAFE_KEYS` -> `LLM_SAFE_KEYS` (already used by tests, so the
  leading underscore was misleading) and update the importer.
- `services/api/app/scripts/seed_demo.py` (#417): drop the unused
  `_quick_rng` module-level RNG; deterministic seeding still flows through
  `_rng_for_tenant`. Replaced with a comment explaining the removal so
  future work doesn't accidentally re-add an unused source of randomness.
- `services/connectors/app/connectors/datadog.py` (#416): remove the unused
  `_EVENTS_PER_PAGE` constant; the Datadog Events v1 API is windowed by
  `start`/`end` epoch seconds, not by a page-size knob, so the constant was
  dead. Added a comment so anyone wiring pagination in later does it inside
  `_fetch_events` instead of reintroducing the global.

py/import-and-import-from (1 alert)
- `services/connectors/tests/connectors/test_confluence_audit.py` (#437):
  collapse the inline `import app.connectors.confluence_audit as mod` into
  a single module-level `import ... as confluence_audit_module` alias and
  reuse it for the `_PAGE_SIZE` monkey-patch.

py/unused-import (1 alert)
- `services/api/app/services/tenant_provision/provisioner.py` (#436):
  unquote `Any` in `DemoSeederCallable = Callable[[AsyncSession, Tenant], Any]`
  so the existing `from typing import Any` is recognised as used. The
  module already has `from __future__ import annotations`, so the string
  form was unnecessary — and it was hiding the only runtime reference.

Verification
- `python3 -m py_compile` clean on all 19 files.
- `ruff format` is a no-op (files already match style).
- `ruff check` passes with no new lint findings.

No behaviour change, no public API change. All edits are sanitisation,
docstring, or static-analysis hint changes.