Ruff Python lints

Runs Ruff over Python sources. Ruff is a standalone Rust binary that parses code and reads pyproject.toml/ruff.toml as plain data; it never imports or executes the target and has no plugin mechanism. When the project has its own ruff configuration it is honoured; otherwise ruff runs with --isolated (no config discovered from parent directories) and the rule set E4,E7,E9,F,B,PLE,S (pycodestyle errors, pyflakes, bugbear, pylint errors, bandit-like security rules; S rules are skipped in tests/).