Pin ruff version so local + CI stay in sync

[RFingAdam]

Problem

CI installs ruff fresh (pip install ruff) → gets latest (≥0.9 with UP045). The local pyproject ignore list includes UP045, but devs with older ruff (e.g. 0.8.x) get Unknown rule selector: UP045 and fail to lint locally.

Acceptance criteria

• ruff pinned in pyproject.toml [project.optional-dependencies].dev with a >= constraint matching what CI uses.
• .github/workflows/ci.yml lint job installs the pinned version (e.g. pip install -e ".[dev]") instead of bare pip install ruff.
• python3 -m ruff check src/ tests/ succeeds locally with the pinned version.
• CI lint job passes on the PR with this change.

[RFingAdam]

Closed by PR #125 (commit ab37f5a). All CI checks (lint / typecheck / test 3.10-3.12) green.