Enable pathlib lint and clean up remaining `os.path` usage

Part of: #1409

Depends on: legacy byte-path helper removal.

## Problem

After the path contracts are migrated, remaining `os.path`, builtin `open`, and path-style `os` calls make it easy to reintroduce string path manipulation. The project needs lint coverage to keep new code on the `Path` API and to expose leftover mechanical cleanup.

## Expected behavior

- Enable Ruff `PTH` rules for production code where practical.
- Replace remaining mechanical `os.path` operations with `Path` methods.
- Use `Path.open`, `Path.read_text`, `Path.write_text`, `Path.exists`, `Path.is_file`, `Path.unlink`, and related methods where they preserve behavior.
- Keep explicit ignores only where the code intentionally operates on path fragments, external formats, or non-filesystem strings.
- Document any remaining ignores with a short reason.

## Suggested fix

Turn on `PTH` after semantic migration is complete, then handle the remaining warnings as mechanical cleanup. Keep intentional exceptions narrow so future byte/string path drift remains visible.

## Acceptance criteria

- Ruff pathlib rules are enabled for the intended scope.
- Remaining `PTH` ignores are targeted and justified.
- Tests cover behavior for any non-mechanical replacement.
- `poe test` and `poe lint` pass with coverage at or above 80%.

Start with the Ruff configuration and inventory the remaining pathlib-related warnings in production code after the legacy byte-path helper removal. Replace only mechanical operations, document narrow intentional ignores, then run `poe test` and `poe lint`; done requires at least 80% coverage and justified remaining PTH ignores.

Written by the indexing model from the issue text.