fix: pin ruff <0.16, and actually run it in CI

[scttfrdmn]

ruff was declared in the dev extra but no workflow ever invoked it, so it
enforced nothing. Found while auditing the Python repos after ruff 0.16 broke
miniwdl-spawn and had left cwl-spawn's main red for six days
(spore-host/cwl-spawn#5).

Pinning alone would have been the tidy-looking fix and would have left the real
gap in place, so this does both.

1. Pin ruff>=0.5,<0.16

ruff 0.16 moved a large set of opinionated rules into its default rule set.
Unpinned here:

	findings
ruff 0.16.1 (unpinned)	76
ruff 0.15.22 (pinned)	3

The 73-finding delta is almost entirely annotation-style suggestions — 36 UP045,
13 UP037, 7 UP006 — that no other repo in the suite enforces. Same cap as
airflow-spawn, cwl-spawn, miniwdl-spawn and
snakemake-executor-plugin-spawn.

2. Add a lint job

ruff check . on 3.12 only — lint results don't vary across the test matrix, so
fanning it out over 3.9–3.12 would just be four times the work for the same answer.

3. Fix the 3 real findings

All in examples/, none in the shipped spore package:

• marimo_example.py built a state_color map from the instance state and then
  never used it (F841) — so the status table rendered **{inst.state}**
  uncolored. The dead variable was the tell that the colorization was written but
  never wired up; now applied, which is what the example meant to demonstrate.
• script_example.py — f-string with no placeholders (F541).
• jupyter_example.ipynb — E402 (import not at top of cell) is inherent to
  notebooks, where each cell is its own top level. Excluded per-file rather than
  contorting the example. Verified the notebook is still linted for everything
  else; E402 is the only ignore.

Verification

• ruff --version → 0.15.22; ruff check . → All checks passed
• pytest tests/ → 19 passed
• Both edited examples parse (ast.parse)
• Confirmed the per-file ignore doesn't silence anything beyond E402

Related: spore-host#518 (the CI outage that started this audit).