ci: pin ruff to a reproducible version for the lint gate

`pip install ruff` grabbed whatever was latest, so a future ruff release that
adds or stabilizes a rule under the selected E/F/W/UP categories could break
lint on an unrelated PR. Pin it:

- workflow: ruff==0.15.16 (exact; verified clean on src/ + tests/)
- pyproject [dev]: ruff>=0.15,<0.16 (cap the minor, allow patch fixes)

Bump deliberately; the two specs are kept in sync via cross-referencing
comments.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jang1563

.github/workflows/ci.yml

@@ -20,7 +20,10 @@ jobs:
           cache: 'pip'
 
       - name: Install ruff
-        run: pip install ruff
+        # Pinned for reproducible lint: a new ruff release must not change the
+        # gate on an unrelated PR. Bump deliberately; keep in sync with the
+        # ruff range in pyproject.toml [project.optional-dependencies].dev.
+        run: pip install "ruff==0.15.16"
 
       - name: Run ruff check
         run: ruff check src/ tests/

pyproject.toml

@@ -38,7 +38,10 @@ dependencies = [
 dev = [
     "pytest>=7.4",
     "pytest-cov>=4.1",
-    "ruff>=0.3",
+    # Capped below the next ruff minor: new minors can add/stabilize lint rules
+    # and would otherwise break CI on unrelated PRs. Keep in sync with the
+    # pinned ruff in .github/workflows/ci.yml.
+    "ruff>=0.15,<0.16",
 ]
 dashboard = [
     "streamlit>=1.30",