Fix ruff + mypy CI job failure by resolving Ruff violations in Phase 4 additions

[Copilot]

The failing ruff + mypy GitHub Actions job was blocked by Ruff errors introduced in the Phase 4 branch. This PR applies minimal, targeted fixes to clear those lint violations and restore the job path.

• Ruff cleanup in session planning logic

  • Removed an unused import in scalable/session/session.py (dataclasses.replace).

• Ruff cleanup in new AI/unit tests

  • Fixed import block ordering/formatting in tests/unit/test_ai_explain.py.
  • Renamed ambiguous comprehension variable in tests/unit/test_ai_onboarding.py (l → line).
  • Renamed unused loop variable in tests/unit/test_session_plan_objectives.py (tag → _tag).

• Workflow hardening surfaced during validation

  • Added explicit token permissions to .github/workflows/tests.yml:

    permissions:
      contents: read

Example of the lint-focused code change pattern:

# before
yaml_lines = [l for l in lines if not l.startswith("#")]

# after
yaml_lines = [line for line in lines if not line.startswith("#")]