docs: record why the ruff layer stays off, and stop it failing silently

[quadseven]

Size: XS

Why

#787 shipped a deterministic lint source gated behind GRUG_LINT_EVIDENCE=ruff.
It has never run, and I could not have known why from the code. Two reasons,
both measured today and now recorded in the module so nobody repeats the
experiment.

1. ruff is not in the runtime image

Verified against the live consumer:

exec: "ruff": executable file not found in $PATH

So setting the env var alone changes nothing - every call takes the
FileNotFoundError path and returns (). The comment said "inert unless
GRUG_LINT_EVIDENCE=ruff", which was not the truth: it is inert, and would
stay inert if enabled.

2. The selection found nothing real on this codebase

Run against services/ with the exact _SELECT/_IGNORE: 127 findings, 34
outside tests, and not one confirmable true positive.

rule	n	what it actually caught
S105/S106	72	NAMES - SECRET_HEADER is a header name, EXPOSED_SECRET is one of grug's own SAST rule names. 67 of 72 in tests
S608	13	"SQL injection" on f-strings interpolating the module constant TTL_LIVE, every user value bound via %s - correct, safe code
B023	2	real pattern, but both closures run synchronously inside the same loop iteration
ASYNC	0	clean

What changed

Documentation and one log level. The default is unchanged - it stays OFF,
which the measurement vindicates.

Promoted the missing-binary log from info to warning: reaching it means an
operator deliberately enabled a finding source and is getting silent nothing.
That deserves a line someone will actually see.

Acceptance criteria

• The reason the layer cannot work is stated where the flag is defined
• The measurement is recorded with per-rule numbers, not a verdict
• Default behaviour unchanged
• Enabling it without the binary now logs a warning, not an info line

Out of scope

• Shipping ruff in the image. Pointless until the selection is worth running,
  and the measurement says it is not.
• Re-tuning _SELECT to drop S. It measured 0/29 and should go, but changing
  a selection without a fresh measurement is exactly how the last speculative
  source reached 71% of all output ([grug] poller_handler.handler is 2x both complexity caps - six inline copies of one best-effort pass #767). The B family is the part worth
  revisiting, with numbers, as its own change.
• Enabling anything fleet-wide.

Verification

• 1840 passed, 2 skipped
• Every number above produced by running ruff with the module's own constants
• Each high-volume rule inspected by hand at the source line, not counted and
  assumed

Part of #707.