INFR: Ratchet the CI lint gate (concrete follow-up to #457)

[mmcky]

Problem

CI runs flake8 --select=F401,F405,E231 — three codes, currently 0 findings. Default flake8 on the same tree reports 577 (ruff: 377, of which 202 auto-fixable). New regressions in everything outside those three codes merge silently; two exhibits from this audit are the no-op sparse-Q assertion in test_ddp.py (ruff B015) and the NameErrors in test_quadsum.py (F821) — both invisible to the current gate.

The narrow --select is almost certainly a workaround for the 41 F822 findings, an unavoidable artefact of the deprecation-shim pattern (shims declare __all__ and resolve names through __getattr__, which flake8 cannot see). Suppressing F822 is legitimate — but it was achieved by suppressing everything else with it; per-file-ignores scoped to the 21 shim modules keeps the rest of the gate. This issue is the concrete follow-up to the long-standing conventions thread in #457.

Proposed change — ratchet, don't boil the ocean

1. Adopt ruff as the single tool, configured in pyproject.toml so the gate is visible and locally reproducible (keep flake8 for one transition release if preferred).
2. One mechanical ruff check --fix PR (~202 findings: import sorting, f-strings, …) — zero behavior change, reviewed as such.
3. Baseline the surviving legacy findings (per-file-ignores / noqa freeze) so the gate turns green at "no new debt", not "no debt".
4. Gate on correctness and bugbear families (F, E7, B, RUF) plus today's three codes. Explicitly defer the ~476 cosmetic whitespace/line-length findings — folding them in would turn a correctness gate into a formatting argument; expand later by team taste on the Conventions for linting the code? #457 thread.
5. Update .github/copilot-instructions.md and the contributing guide to the new command.

Acceptance criteria

• CI fails on a PR introducing any gated finding; passes on main
• Auto-fix wave merged separately from any behavioral change
• Conventions for linting the code? #457 closed with a summary linking the adopted config

---

From the July 2026 technical-debt audit (AI-assisted; claims verified against 28d4b3b on 2026-07-25).