Fix backend defects, gate CI on lint/tests, tidy packaging + docs

[duckyquang]

Release-prep pass on the backend: fix real defects, make lint gate CI, tidy packaging and docs. Minimal diffs, no logic refactors.

Code fixes

• web/app.py (BLOCKER, F821 → HTTP 500): the legacy /classic/sessions/{id} and /classic/.../hypotheses/{hid} routes call hyp_repo.list_for_session(...) / hyp_repo.fetch(...) but the repo was never imported — every hit NameError'd (500). app.py:create_app is the Docker CMD / co-scientist serve entrypoint. Added from ..storage.repos import hypotheses as hyp_repo; dropped the unused datetime imports.
• web/react_api.py (RUF006): the live-spawn path did asyncio.create_task(_bg()) without keeping a reference, so the event loop's weak ref let a running session be garbage-collected mid-flight. Anchored it in a module-level set() with add_done_callback(discard). Run logic unchanged.
• agents/generation.py, agents/reflection.py: the dead defensive branches now raise a neutral ValueError("unsupported ...") instead of NotImplementedError("... lands in a later milestone"), so they read as guards rather than unfinished work.

Lint — ruff check . now zero errors (was 23)

F401 / F841 / I001 / UP037 / B905 / RUF001 across web/spa.py, webapp/*, scripts/build_bench_report.py. zip(strict=) chosen per call site: False where slice-pairing ([::2]/[1::2]) intentionally drops a leftover, True where the row width always matches the column list. RUF001 ambiguous −/× in bench-report strings replaced with ASCII.

CI hardening

• test.yml: added a ruff check . step so lint gates.
• deploy-pages.yml: the build job (which deploy already needs) now installs deps + runs ruff check . + pytest before building, so a red suite blocks the Pages deploy.

Packaging (pyproject.toml)

version → 1.0.0 (matches frontend/package.json), added [project.urls] and classifiers, author set to Quang Bui.

Docs

git mv docs/superpowers → docs/design (no code references to update).

Verification

• ruff check . → All checks passed
• pytest co_scientist/tests/unit -q → 283 passed
• create_app() imports without NameError; both /classic/... routes render 200 against a seeded session + hypothesis (B1 proven end-to-end)
• All workflow YAML parses; pyproject.toml parses with version 1.0.0

🤖 Generated with Claude Code