INFR: Ratchet the CI lint gate (concrete follow-up to #457)

Problem

CI runs flake8 --select=F401,F405,E231 — three codes, currently 0 findings. Default flake8 on the same tree reports 577 (ruff: 377, of which 202 auto-fixable). New regressions in everything outside those three codes merge silently; two exhibits from this audit are the no-op sparse-Q assertion in test_ddp.py (ruff B015) and the NameErrors in test_quadsum.py (F821) — both invisible to the current gate.

The narrow --select is almost certainly a workaround for the 41 F822 findings, an unavoidable artefact of the deprecation-shim pattern (shims declare __all__ and resolve names through __getattr__, which flake8 cannot see). Suppressing F822 is legitimate — but it was achieved by suppressing everything else with it; per-file-ignores scoped to the 21 shim modules keeps the rest of the gate. This issue is the concrete follow-up to the long-standing conventions thread in #457.

Proposed change — ratchet, don't boil the ocean

1. Adopt ruff as the single tool, configured in pyproject.toml so the gate is visible and locally reproducible (keep flake8 for one transition release if preferred).
2. One mechanical ruff check --fix PR (~202 findings: import sorting, f-strings, …) — zero behavior change, reviewed as such.
3. Baseline the surviving legacy findings (per-file-ignores / noqa freeze) so the gate turns green at "no new debt", not "no debt".
4. Gate on correctness and bugbear families (F, E7, B, RUF) plus today's three codes. Explicitly defer the ~476 cosmetic whitespace/line-length findings — folding them in would turn a correctness gate into a formatting argument; expand later by team taste on the #457 thread.
5. Update .github/copilot-instructions.md and the contributing guide to the new command.

Acceptance criteria

• CI fails on a PR introducing any gated finding; passes on main
• Auto-fix wave merged separately from any behavioral change
• #457 closed with a summary linking the adopted config

From the July 2026 technical-debt audit (AI-assisted; claims verified against 28d4b3b on 2026-07-25).

Start by reading the current CI configuration, pyproject.toml, .github/copilot-instructions.md, the contributing guide, and the conventions discussion in #457. Determine how the existing flake8 gate and shim exceptions are configured, then define the separate ruff auto-fix, baseline, and CI changes. Done means gated findings fail CI, main passes, documentation names the new command, and #457 is summarized and linked.