ci: pin ruff select to the intended F + core-E policy (unblocks all PRs)

[adamjohnwright]

Problem

The ruff Check workflow runs ruff check src/ bin/ on pull_request only — never on main. So main accumulated ~400 lint findings that were never gated, and now every PR fails ruff on that pre-existing backlog, regardless of what it changes.

Root cause

[tool.ruff.lint] sets ignore but never pins a select. Its own comment states the intent — "real issues (F, other E) stay enforced." Under exactly that policy the codebase is clean:

ruff check src/ bin/ --select E4,E7,E9,F --ignore E701,E702  →  All checks passed!

Without an explicit select, newer ruff enforces ~10 extra rule families that were never intended. ~310 of the ~400 findings are UP006 (List → list PEP-585 modernization); the rest are import-sorting, blind-except, etc. Zero real F/E issues. The last config commit (04d68c9) clearly meant F+E and just forgot to pin select; it passed on that ruff version and drifted since.

Fix

Pin the select to the documented intent:

[tool.ruff.lint]
select = ["E4", "E7", "E9", "F"]
ignore = ["E701", "E702"]

• Greens CI for every open PR at once, zero code changes.
• Stable against ruff default drift.
• Opting into pyupgrade / import-sort / etc. later is a deliberate choice + its own cleanup PR (not silently-on via a default).

Verification

ruff check src/ bin/ (config-driven, no CLI flags) → All checks passed!

🤖 Generated with Claude Code