Adopt ruff 0.16 and lift the ruff<0.16 pin

[TKaltofen]

Summary

pyproject.toml pins ruff<0.16 as a stopgap; adopt ruff 0.16 properly and remove the pin.

Motivation

The pin landed in #92 because ruff 0.16.0 turned main red for every PR with no code change behind it. On an identical working tree:

ruff	source	ruff check .
0.15.22	resolved by uv.lock	All checks passed!
0.16.0	resolved fresh by tox	Found 1772 errors.

Two things changed in 0.16:

1. The default rule set widened. [tool.ruff] here sets only line-length, so the repo inherits ruff's defaults: 1009 UP006, 413 UP035, 130 RUF012, 75 I001, 74 UP045, plus a tail of UP007/RET501/UP037/SIM/TRY/BLE/FURB.
2. ruff format began formatting python code blocks inside markdown. Three docs files were reformatted in chore(deps): bump torch to 2.13.0 and setuptools to 83.0.0 #92 to match; both 0.15.22 and 0.16.0 accept the result, so that part is already done.

Scope

• ruff check --fix clears 1216 of the 1772 mechanically, largely List/Dict -> list/dict (UP006, UP035).
• The remaining ~550 need judgment, chiefly RUF012 (mutable class defaults) and the smaller rules.
• Consider adding an explicit [tool.ruff.lint] select in the same change. Inheriting ruff's defaults is what made a minor release silently redefine the gate; an explicit rule set makes that a repo decision instead.

Code pointers

• pyproject.toml:42-46 (the pin and its comment)
• pyproject.toml:103-105 ([tool.ruff], no rule selection)
• tox.ini:23-29 (gate commands)

Related

There is a deeper cause worth tracking separately: tox.ini uses usedevelop = true with extras, so the gate resolves dev tooling fresh from unpinned ranges rather than from uv.lock. That is why an upstream release can change CI's verdict at all, and it applies equally to mypy, bandit and pytest. runner = uv-venv-lock-runner is the fix (mloda uses it for exactly this reason), but it is currently blocked: uv sync --locked fails on Python 3.10 because the lock resolved onnxruntime==1.24.3, which ships no cp310 wheels. The lock has to be made installable across 3.10 to 3.14 first.

Definition of done

• ruff<0.16 is back to ruff in the dev extra, comment removed.
• tox passes on 3.10, 3.13 and 3.14 with ruff 0.16.x.
• Rule selection is explicit, or a note records the decision to keep inheriting defaults.