SIENTIAPDE-1646

Simplify bandit nosec comments and mock metrics_controller with real spe

- drift.py/simple_metrics.py: move nosec rationale to a code comment above
  the query instead of an inline suppression comment, keeping bandit happy
  with a plain `# nosec`
- tests: replace bare `MagicMock()` with `MagicMock(spec=MetricsController)`
  for metrics_controller across activities/repository tests so mocks fail
  fast on attribute typos instead of silently accepting any call

tests/laborious/activities/test_gates.py

@@ -3,6 +3,7 @@ from unittest.mock import ANY, MagicMock, call, patch
 from pandas import DataFrame
 from pytest import fixture
 from sientia_do.notifications.models import NotificationLevel
+from sientia_do.observability.metrics_controller import MetricsController
 from sientia_do.observability.sientia_monitoring import SientiaMonitoring
 
 from laborious.activities.gates import Gates
@@ -38,7 +39,7 @@ def gates_activity():
     gates = Gates(
         logger=MagicMock(),
         notification_handler=MagicMock(),
-        metrics_controller=MagicMock(),
+        metrics_controller=MagicMock(spec=MetricsController),
     )
     gates.error = MagicMock()
     gates.debug = MagicMock()
@@ -985,7 +986,7 @@ def test_close_disposes_minio_repository(mock_shutdown):
         minio_repository=minio,
         logger=MagicMock(),
         notification_handler=MagicMock(),
-        metrics_controller=MagicMock(),
+        metrics_controller=MagicMock(spec=MetricsController),
     )
     gates.close()
     minio.close.assert_called_once()
@@ -1000,7 +1001,7 @@ def test_close_without_minio_repository(mock_shutdown):
         minio_repository=None,
         logger=MagicMock(),
         notification_handler=MagicMock(),
-        metrics_controller=MagicMock(),
+        metrics_controller=MagicMock(spec=MetricsController),
     )
     gates.close()
     mock_shutdown.assert_called_once_with(gates)