Select DTZ and make every datetime explicitly UTC

[antiguru]

Stacked on #38625, which is stacked on #38624. Both must land first, so until they do the diff here also shows their commits. Review only the Select DTZ and make every datetime explicitly UTC commit.

This is the first of the additional lint rules discussed on #38625. The others are outlined at the bottom; they are not in this branch yet.

A naive datetime carries no offset, so what it means depends on the machine that produced it. In a codebase whose subject is timestamp semantics that is a poor default. The 54 sites this rule reports divide into two kinds.

The first kind is absolute time, and there the rule finds real defects. Epoch values are UTC by definition, so fromtimestamp without a timezone reinterprets them in local time, wrong by the machine's offset. The same applies to utcnow, which returns a naive value that then compares incorrectly against anything aware, to date.today, and to a strptime format ending in a literal Z that never records the zone it just parsed.

The second kind is deadline and elapsed-time arithmetic, end_time = now() + timedelta(...) followed by while now() < end_time. Both sides move together, so the offset cancels and reading the clock as UTC changes nothing. Worth saying plainly: those would be better served by time.monotonic, which no clock adjustment can move, and this change does not address that.

Why this needed manual work

Timezone-aware and naive values cannot be compared or subtracted, so a partial conversion raises TypeError at runtime, and neither ruff nor pyright would catch it. Values that flow into each other had to be converted together:

• delete_after and _format_expires in scratch.py
• get_last_modification_date against max_modification_date in data_io.py

Sources the rule does not police were audited as well, since a naive value can still arrive from fromisoformat or a bare constructor. canary-load already normalises its fromisoformat result before comparing, so nothing there conflicts.

Where a value is rendered rather than compared, output moves from local time to UTC. That affects a handful of log and assertion messages, and makes them unambiguous.

Verification

bin/lint passes in full, including pyright. Separately, all 26 touched files were import-loaded to catch anything the static checks miss, which matters because temporal.py had its date import replaced with datetime.

Remaining rules, not in this branch

Measured against the tree, with the caveats found while investigating:

• B905, zip() without strict=, 44 sites. Direct precedent: clippy.toml bans std::iter::Iterator::zip with "use Itertools::zip_eq instead", so the project has already taken this position on the Rust side. It needs care rather than a bulk edit, because strict=True turns silent truncation into a runtime exception, and several sites may zip genuinely unequal sequences: zip(this_stats.keys(), other_stats.keys()) in parallel-benchmark, zip(self.params, args) in output_consistency/operation.py, and zip(*dependency_sets) in mzbuild.py.
• B006, mutable argument defaults, 88 sites, for example environment_extra: list[str] = [] in checks/mzcompose_actions.py. Latent rather than currently firing, but one append turns any of them into state shared across calls.
• B904, raise inside except without from, 55 sites, which discards the causing traceback.

Deliberately not proposed: S (3130 findings, bandit against test infrastructure), T (1838, bans print in CLI tools), FBT (1434), INP (474, all false positives since standalone mzcompose.py files correctly lack __init__.py).

One rule that looked promising and is not worth taking: B023, function uses loop variable, 13 sites. They are benign here. In mzbuild.py the closures go straight to spawn.run_with_retries, which invokes them inside the same iteration, so late binding never bites.

Release notes

No user-visible changes.

🤖 Posted by Claude Code