tooling: decide on ruff format, and on enabling B/S so the existing noqas stop being inert

#303 migrated the linter from flake8 to ruff, **linter only**, as an explicit drop-in: same enforced set (`E9,F63,F7,F82`, 0 findings both), 0.055 s vs 3.5 s, zero `.py` files changed. Two decisions were deliberately deferred out of that PR.

## 1. Adopt `ruff format`?

`ruff format` is black-compatible, and ruff is already the linter, so this would collapse two tools into one.

The cost is a single large commit: **~280 files** would be reformatted. That is a big diff and it moves `git blame` (mitigable with `.git-blame-ignore-revs`).

The argument *for* doing it as one commit rather than gradually: gradual adoption has already been tried here and did not converge. `black = "^23.7.0"` has been a dev dependency for years, is in no workflow, has no `[tool.black]` section, and **262 of 596 files are unformatted**. A "format on touch" policy is the mechanism that produced that state.

Related loose end either way: `black`'s default width is 88 while `[tool.ruff] line-length` is 127, so the two disagree today.

## 2. Enable `B` (bugbear) and `S` (bandit)?

The repo already writes suppressions in ruff's vocabulary that plain flake8 never had rules for, so they have been inert no-ops:

```
9x # noqa: BLE001 (blind-except — a bugbear rule)
1x # noqa: S324
1x # noqa: S310
```

Someone has been writing for a linter this repo did not run. Enabling `B` takes the advisory count from 233 to 324; those 11 noqas would become meaningful.

Note this is the *advisory* (`--exit-zero`) pass, so enabling them does not block anything — it only changes what the informational report covers.

## 3. Smaller, related

The advisory pass lost coverage in the swap that is worth knowing about: flake8's default selection included the whitespace/blank-line families (E1xx/E2xx/E3xx, W291/W293), but those rules are **preview-gated** in ruff and the pass does not set `preview = true`. Concretely, `E303 too many blank lines` no longer fires — which is why the review, not CI, is what caught the four-blank-line run #303 left behind. Setting `preview = true` on the advisory pass would restore it.

Start by reviewing the existing [tool.ruff] configuration and the advisory lint pass described in the issue. Compare the effects of adopting ruff format, enabling B and S, and setting preview = true, including the reported file counts and noqa rules. Done means the project has made and documented these configuration decisions, with any resulting formatting or advisory changes accounted for.

Written by the indexing model from the issue text.