Fix hardened container CI startup

[AlphaHorizon-AI]

What changed

• prevent server-mode startup from rewriting /app/.env in read-only containers
• resolve the Gensui JWT secret file beneath the configured writable data directory
• align Gensui Ruff rules with the repository CI policy and fix import ordering
• add regression coverage for immutable Shogun and Gensui startup paths

Root cause

The hardened containers intentionally run with read-only root filesystems. Shogun attempted to update /app/.env, while Gensui derived its default JWT secret location from the package directory (/app/gensui/data) instead of the mounted writable data path (/app/data). The Python job also picked up Gensui's separate Ruff configuration, exposing import-order failures and FastAPI-specific rules outside the intended CI selection.

Impact

Both containers can start using their mounted writable paths, and the Python security lint gate is deterministic.

Validation

• exact Security hardening Ruff target passes
• 76 security regression tests pass
• 27 targeted startup/security tests pass
• telemetry privacy contract passes
• git diff --check passes

Docker runtime verification remains for GitHub Actions because the local Docker daemon was unavailable.