Pin ruff to a minor line and split lint from tests in CI

[AlexisJanin]

Fixes #79.

Why

select = ["ALL"] with an unpinned ruff gave Astral's release cadence a vote on whether our branches are green. 0.16 added CPY001 and began formatting Python blocks inside Markdown, and #64 went red for six weeks as a result.

Worse, the red carried no signal: lint and tests shared one job, so the failing format step ended the job before pytest ran, and fail-fast cancelled the sibling. Note that dropping fail-fast alone would not have fixed this — both matrix jobs run the same format check and would have failed at the same step.

What changed

Area	Change
Version	Cap ruff to >=0.16.2,<0.17 in the dev extra. Formatter and rule changes now arrive on a bump PR opened deliberately, not on whichever PR happens to be open. A venv on 0.15.x now fails the constraint and self-corrects on pip install -e .[dev].
Rule surface	select = ["ALL"] stays — with the cap, it's a subscription to work at bump time rather than to surprise.
CI shape	Split into lint (once — ruff's verdict is interpreter-independent, target-version fixes the syntax target) and test (3.11/3.13 matrix, pytest only). Lint can no longer gate tests, and ruff runs once instead of twice.
Diagnostics	ruff --version echoed in every run, so a version mismatch is visible in the log's first lines instead of costing an investigation.
Scope	Checked scope widened from src/ to . — clean today, and it starts enforcing the scripts/* rules ruff.toml already configures. Tests stay excluded.
Cleanup	Dropped per-file-ignores for paths that no longer exist (example/* has zero .py files; API/app.ipynb is gone) and the spent PT011 entry (0 hits).
Policy	Recorded in pyproject.toml (why the cap exists) and CONTRIBUTING.md (how to raise it).

Bumps stay manual and one minor at a time — deliberately no Dependabot: trailing a linter release is harmless, while a bot opening dependency PRs is its own maintenance surface.

How to test

This PR is its own test — the rewritten workflow runs on it, and you should see three independent checks (Lint, Test Python 3.11, Test Python 3.13) rather than one job whose failure hides the others. The Ruff version step reports which 0.16.x the cap resolved to.

Locally, from the project venv:

pip install -U -e .[dev]
ruff --version              # expect 0.16.x
ruff format --check .       # clean
ruff check .                # clean
pytest

To see the masking fix directly: introduce a formatting error, and confirm the test jobs still run and report.

Not in scope

• ruff check tests/ reports 390 errors (tests are excluded from linting via ruff.toml).
• The workflow only triggers on pushes and PRs targeting main, so PRs into dev get no CI at all.

🤖 Generated with Claude Code