ci: pin ruff rule set so upstream default changes don't break CI

Author: mckeea

.github/workflows/validate.yml

@@ -58,7 +58,8 @@ jobs:
           echo "🔍 Running ruff..."
           pip install --quiet ruff
           # Lint every .py under .github/scripts/ - fails the job on any issue.
-          # Style-only (no auto-fix). ruff defaults cover pyflakes + pycodestyle.
+          # Style-only (no auto-fix). Rules come from ruff.toml, not ruff's
+          # defaults, which move between releases.
           ruff check .github/scripts/
           echo "✅ ruff passed"
 

ruff.toml

@@ -0,0 +1,6 @@
+# Pin the rule set instead of inheriting ruff's defaults. 0.16.0 widened them
+# (pyupgrade and friends) and turned CI red without a line of code changing.
+# These four are what the scripts have always been linted against: pyflakes
+# plus the pycodestyle checks that catch real errors rather than formatting.
+[lint]
+select = ["E4", "E7", "E9", "F"]