Migrate to ruff 0.16 and decide which rule set to adopt

ruff 0.16 enables 413 rules by default, up from 59 ([release notes](https://astral.sh/blog/ruff-v0.16.0)). Because pyproject.toml declared ruff>=0.13.2 with no upper bound, CI resolved to 0.16 automatically and the lint job started failing on PRs that touch none of the affected files. ruff is now pinned to 0.15.17.

Start with pyproject.toml and the CI lint job, then read the linked Ruff 0.16 release notes and compare them with the current Ruff 0.15.17 configuration. Done means the project has an agreed Ruff rule set, the dependency policy is updated, and CI passes without lint failures on unrelated files.

Written by the indexing model from the issue text.