build: pin ruff's rule selection so the lint gate measures the change

CI installs ruff unpinned, so with no config block ruff applied whatever its
current default rule set happens to be. That set has widened considerably
since this gate was written, and ruff 0.16.4 reports 59 errors on an
unmodified origin/main (361df8d) -- I001, UP024, SIM*, BLE001, DTZ003, S110,
RUF*, FURB*. The gate was red on main itself, so any PR inherited a wall of
findings it did not cause.

Pin select = ["E4", "E7", "E9", "F"], which is ruff's own pre-widening
default and the rule set this codebase was written against. Verified with
ruff 0.16.4 against a detached worktree of origin/main: 0 errors across
src/ and tests/, both via --config and with the block grafted into main's
own pyproject.toml. `ruff check src/ tests/` is now green on main's code
and on this branch, so the gate reports only what a PR actually changes.

Rules that fire on unmodified main are deliberately left out rather than
silenced file-by-file: I (22), UP (16), B (5), C4 (1). Enabling any of them
is a real cleanup that belongs in its own commit, not smuggled into a
hardening branch. E501 is excluded because black owns line length and the
two cannot both be green here -- see the comment in pyproject.toml.

Uses [tool.ruff.lint] rather than a top-level select; ruff 0.16.4 warns that
the top-level linter settings are deprecated, and that warning would be the
same drift problem returning by another route.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: audriB

pyproject.toml

@@ -27,6 +27,34 @@ dev = [
     "pytest",
 ]
 
+# Pin the lint rule selection.
+#
+# CI installs ruff unpinned (`pip install ruff black` in
+# .github/workflows/python-package.yml), and with no config block ruff falls
+# back to its *current* default rule set, which has widened substantially
+# since this gate was written. ruff 0.16.4 reports 59 errors on an unmodified
+# origin/main (I001, UP024, SIM*, BLE001, DTZ003, S110, RUF*, FURB*), so the
+# gate had stopped measuring the change under review and started measuring
+# toolchain drift -- and it fails on `main` itself.
+#
+# E4/E7/E9/F is ruff's own pre-widening default: the rule set this codebase
+# was actually written against. Verified with ruff 0.16.4 against a worktree
+# of origin/main (361df8d): 0 errors across src/ and tests/.
+#
+# Deliberately NOT enabled. Each of these fires on unmodified main, so each
+# needs its own dedicated cleanup commit rather than riding along with
+# unrelated work:
+#   I  -- 22 unsorted import blocks      B  -- B027 x2, B904 x2, B905 x1
+#   UP -- UP015 x8, UP024 x8             C4 -- C420 x1
+#
+# E501 is excluded on purpose rather than by oversight: black owns line
+# length. This repo pins no black config, so black formats at its own default
+# of 88 columns, and it still leaves 38 lines over 88 on main (long strings
+# and URLs it will not split). E501 and `black --check` therefore cannot both
+# be green here, whatever limit is chosen.
+[tool.ruff.lint]
+select = ["E4", "E7", "E9", "F"]
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 markers = [