[EPIC] Adopt ruff for linting/formatting, replacing flake8

[squid-protocol]

Problem Statement

flake8 was installed and configured (`.flake8`), but CI only ever ran a minimal syntax-floor check against it (`flake8 . --count --select=E9,F63,F7,F82`) -- real linting was never actually enforced. `.flake8`'s own `extend-ignore` list (E203, W503, E501, E741, W291, W293, F401, F841) shows this was already known to be a bare-minimum setup, not a real quality gate.

There was also a `[tool.ruff]`/`[tool.black]` config already sitting in `pyproject.toml` from an earlier commit (`6378f3ad`, `27121138`) that was never actually wired into CI or installed as a dependency.

What's landing

Replacing flake8 with ruff (both lint and format), using the same baseline-gated CI pattern established for mypy (#429) and `dead_key_audit.py` (#325), so the pre-existing backlog doesn't block every unrelated PR while still catching regressions immediately.

• `ruff format`: adopted repo-wide (29 files reformatted in the adoption PR), enforced as a zero-tolerance CI check going forward (no backlog to carry -- the whole repo was just brought into compliance once).
• `ruff check` (lint): a deliberately scoped rule selection (not `ALL`), measured against this codebase's actual patterns before deciding what to include/exclude. Baseline-gated the same way mypy's baseline is -- new findings fail CI, the existing backlog doesn't.

See the adoption PR for the full measured rationale behind each rule family's inclusion/exclusion.

Current State (measured, not estimated)

After a one-time cleanup pass (`ruff check --fix`, a scoped `--unsafe-fixes` pass for PEP 585 typing modernization confirmed safe via a clean mypy re-run, and `ruff format`):

240 lint findings across 27 rule families, none dominant (largest is `SIM102` at 17 hits). Full breakdown and per-rule counts in the adoption PR.

Sub-issues to follow, splitting the 240-finding baseline into worked-down chunks the same way #432/#433 split the mypy baseline.