fix(ci): pin the ruff version and state the lint rule set explicitly

[sligara7]

The problem

main is red on CI right now, and no commit caused it.

The lint step runs ruff check src tests examples after pip install -e ".[dev]", and the extra declared an open-ended ruff>=0.1. So CI installs whatever ruff shipped most recently. Meanwhile [tool.ruff] set only line-length and target-version — no rule selection — which means the enforced rule set was whatever that ruff version happened to default to.

ruff 0.16.0 widened those defaults (I, RUF, SIM, PL, UP). Overnight, 40 findings appeared:

Rule	Count
I001 (import sorting)	17
RUF022	7
RUF010	3
SIM114, PLR0402	2 each
UP035, RUF100, RUF059, RUF012, PLW1510	1 each

All in files no open PR had touched — retroactively failing work that was green when written.

Proof it is not any branch's fault: running ruff 0.16.0 against unmodified main produces the same 40 errors. The last green CI on main was 2026-07-01, before 0.16.0 existed.

This also blocks #8, whose 4 failing checks are this and not its own diff.

The fix — two changes, two independent causes

• ruff>=0.5,<0.17 — bound the tool on both sides so the gate is reproducible. Floor is 0.5 because the rule set below uses the [tool.ruff.lint] table.
• [tool.ruff.lint] select = ["E4","E7","E9","F"] — state the enforced set explicitly, so it is a property of this repo rather than of the installed ruff. This is the load-bearing half: without it, the next default-widening release moves the gate again no matter what version is pinned.

Those four are what the project has actually been enforcing (ruff's historical default): pyflakes plus the pycodestyle errors that catch real mistakes.

What this deliberately does NOT do

No source file is touched. Adopting import sorting or the RUF/SIM/UP families is a real improvement, but it is a deliberate choice deserving its own commit with its ~40 fixes reviewed — not something that should arrive as a side effect of a dependency resolving forward. 30 of the 40 are --fix-able and 5 need --unsafe-fixes, so it is a reviewable change whenever you want it.

Verification

• ruff 0.16.0 (what CI installs) → All checks passed
• ruff 0.15.15 (local) → All checks passed

The point is not that either passes; it is that they now agree, which is what pinning the rule set buys.

• pytest: 1654 passed. The single failure, test_version_matches_package_metadata, is a stale editable install on the dev host (metadata 0.25.0 vs source 0.26.0); it reproduces on unmodified main and CI installs fresh.

After this merges

#8 needs a rebase onto main to pick up the pin, and should then go green.