refactor: move writable-dir constants to core.paths, fix workflow->tools layer violation

refactor: tighten invariant-length zips to strict=True (B905)

style: apply ruff lint --fix + ruff format across the tree

feat(integration): ComBat per-sample scoring tool decoupler_pool_cohorts (ADR-0001 item 10)

refactor(loader): centralize authenticated URL->local resolution

ADR-0001 Phase 2 Mode A: early integration (T7 + T8 + T9)