pre-commit: ruff-check fails with real lint errors (F841/E402/F821) in non-template scripts

Part of #213.

## Problem

`ruff-check` (configured with `--fix --exit-non-zero-on-fix`) reports genuine lint violations in tracked, non-template Python files. Error codes observed: `F841` (assigned-but-unused), `E402` (import not at top), `F821` (undefined name).

## Affected files (non-template)

```
plugins/deploy-on-aws/scripts/lib/post_process_drawio.py
plugins/sagemaker-ai/skills/finetuning/templates/rlvr_reward_function_source_template.py
plugins/sagemaker-ai/skills/model-evaluation/scripts/reward_function_source_template.py
tools/validate-urls.py
```

(Note: the `code_templates/*.py` files also appear in ruff output but are covered separately by #214 — they fail to parse rather than lint.)

## Reproduce

```bash
mise exec -- pre-commit run ruff-check --all-files
```

## Proposed fix

Triage each finding: `F821` (undefined name) may be a real bug worth verifying; `F841`/`E402` are typically safe to fix directly or via `ruff check --fix`. For the `*_source_template.py` files that are code fragments, consider a per-file `# ruff: noqa` or excluding them if they are not standalone modules.

_{Filed with assistance from Claude Code while implementing #211.}

Start by running `mise exec -- pre-commit run ruff-check --all-files`, then inspect the reported findings in `plugins/deploy-on-aws/scripts/lib/post_process_drawio.py`, the two listed `*_source_template.py` files, and `tools/validate-urls.py`. Verify whether the F821 findings are real bugs and handle the F841/E402 findings appropriately, including the template-file treatment. Done means the affected non-template files no longer produce these lint errors.

Written by the indexing model from the issue text.