chore: split Makefile lint target into lint (check) and lint-fix (auto-fix)

Previously `make lint` ran `ruff format` and `ruff check --fix` — both in
auto-fix mode — so it silently mutated files instead of reporting issues.
CI, on the other hand, runs `ruff format --check` and `ruff check` in
check-only mode, which is what actually fails a PR. That asymmetry meant a
clean local `make lint` gave no guarantee that CI would pass: running it
would just reformat files in-place, and the developer might miss the
uncommitted changes.

Splits into two targets:

  - `make lint` now mirrors CI (ruff format --check, ruff check, mypy).
    A clean run guarantees the CI Lint job will pass.
  - `make lint-fix` is the previous behavior (auto-fix formatter + linter)
    for convenient local cleanup.

Caught while working on #350 — my local `ruff check` calls did not run the
formatter at all, and even `make lint` would have only silently reformatted
the files, leaving a surprise CI failure.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: nhorton

Makefile

@@ -1,5 +1,17 @@
+# `make lint` mirrors CI (.github/workflows/validate.yml) in check-only mode
+# so that a clean local run guarantees CI will pass. Use `make lint-fix` to
+# auto-fix formatter and linter issues locally.
+
+.PHONY: lint lint-fix
+
 lint:
-	@echo "## make lint output"
+	@echo "## make lint output (check-only — matches CI)"
+	uv run ruff format --check src/ tests/
+	uv run ruff check src/ tests/
+	uv run mypy src/
+
+lint-fix:
+	@echo "## make lint-fix output (auto-fix)"
 	uv run ruff format src/ tests/
 	uv run ruff check --fix src/ tests/
 	uv run mypy src/