chore: pin the Ruff rule set and point Dependabot at dev

.github/dependabot.yml

@@ -1,13 +1,19 @@
 # Keeps GitHub Actions and Python (uv) dependencies fresh. The github-actions
 # updates also handle version drift on the Actions pinned in CI, so we don't
 # hand-pin them to commit SHAs.
+#
+# target-branch is set on every entry because Dependabot otherwise opens against the
+# default branch (main), while CONTRIBUTING requires PRs to be based on dev. Without
+# it, a merged bump lands on main only and dev's CI keeps testing the old version.
 version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
+    target-branch: "dev"
     schedule:
       interval: "weekly"
   - package-ecosystem: "uv"
     directory: "/"
+    target-branch: "dev"
     schedule:
       interval: "weekly"

pyproject.toml

@@ -63,3 +63,11 @@ pythonpath = ["src"]
 [tool.ruff]
 line-length = 100
 target-version = "py311"
+
+# Pin the rule set explicitly. Without this, the project inherits whatever Ruff's
+# defaults happen to be, so "lint clean" changes meaning on a Ruff upgrade rather
+# than on a decision here — 0.16.0 widened the defaults and surfaced 84 findings in
+# unchanged code. These four are Ruff's classic defaults and are exactly what CI
+# enforced before the pin. Widening the set is a deliberate, separate change.
+[tool.ruff.lint]
+select = ["E4", "E7", "E9", "F"]