Tooling: coverage excludes, pre-commit, ruff ignores, CI, dependency floors

[allen0099]

Tooling cleanups.

Running the badge deploy on pull requests, listed here originally, was fixed by #151; the rest is tracked in #193.

Split into one sub-issue per pull request:

• Coverage: anchor the exclude_lines patterns #190
• pre-commit: remove the duplicate hook, stop upgrading the lock, fix mypy deps #191
• Ruff: drop stale ignores and scope the rest #192
• CI: scope coverage.yml write permission, reduce test/tox overlap #193
• Declare lower bounds for runtime dependencies #194

[allen0099]

All sub-issues are done; closing.