Summary

• pin Ruff and its lockfile to 0.16.0 and require that exact version
• apply the newly enabled default checks across application code, scripts, and tests
• make shebang-bearing scripts executable and refresh the generated HTML cache version
• document the small set of intentional dynamic-execution and host-runtime exception boundaries

Why

Ruff 0.16 expands its default rule set. Pinning the version makes that change deliberate and reproducible instead of allowing a future install to change CI behavior unexpectedly.

Testing

• make verify (224 unit tests plus project quality, browser-layout, search, Ruff, social-card, and generated-artifact checks)
• uv run --locked ruff check src tests scripts