pyproject.toml

@@ -88,6 +88,11 @@ ignore = [
 
 [tool.ruff.lint.per-file-ignores]
 "__init__.py" = ["F401"]
+"tests/integration/harness.py" = [
+    "S101",
+    "S603",  # the harness drives the trusted local docker CLI with fixed argv
+    "S607",  # docker is resolved from PATH on purpose (CI and local hosts differ)
+]
 "tests/**" = [
     "S101",  # assert is the point of tests
     "S105",  # hardcoded fake tokens in fixtures

tests/integration/harness.py

@@ -12,6 +12,7 @@ and are excluded from ``repr`` and from every error message.
 from __future__ import annotations
 
 import atexit
+import contextlib
 import os
 import secrets
 import signal
@@ -136,10 +137,9 @@ def cleanup_resources(res: RunResources) -> None:
 def cleanup_all() -> None:
     """Clean every run still registered (atexit and signal path)."""
     for res in list(_ACTIVE.values()):
-        try:
+        # Best effort during interpreter exit: never let cleanup raise.
+        with contextlib.suppress(Exception):
             cleanup_resources(res)
-        except Exception:  # noqa: BLE001 - best effort during interpreter exit
-            pass
 
 
 def _signal_handler(signum: int, frame: FrameType | None) -> None: