Apply the ruff fix CI's --unsafe-fixes run wanted

`crdt-sync pre-commit` went red on the previous two commits: pytest is only
referenced in annotations in the _cli split, so TC002 moves it into the
type-checking block.

Missed locally because I ran `ruff check` directly, while the hook passes
`--fix --unsafe-fixes --exit-non-zero-on-fix`. TC002's fix is classed unsafe,
so a bare `ruff check` reports nothing and CI still rewrites the file. The
lesson generalises past this file: for this repo, `pre-commit run --all-files`
is the check, not `ruff check` -- the same trap the prompt already recorded
for re-export pruning.

Verified after the fix: 18 tests, tool/google_id_token.py still 100% branch,
and `pre-commit run --config crdt-sync/.pre-commit-config.yaml --all-files`
clean end to end.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CFSGeWxHPY5rHUGrPqhcmG

crdt-sync/crdt_sync/tests/test_tool_google_id_token_cli.py

@@ -15,8 +15,6 @@ import logging
 from typing import TYPE_CHECKING
 from unittest.mock import patch
 
-import pytest
-
 from crdt_sync.tests.test_tool_google_id_token import (
     _CLIENT_CREDENTIAL,
     _CLIENT_ID,
@@ -27,6 +25,8 @@ from tool import google_id_token as git
 if TYPE_CHECKING:
     from pathlib import Path
 
+    import pytest
+
 
 def test_main_prints_the_token_when_no_output_is_given(
     caplog: pytest.LogCaptureFixture,