[wic][PATCH v4 4/6] add ruff linting

Lint with ruff via just recipes. lint-tests runs ruff over tests/ and
is held to a clean bar; lint also runs it over src/, whose findings are
a preview since the wic source is not yet ruff-clean. ruff joins the
tests extra and .gitignore ignores its .ruff_cache/.

ruff is pinned exactly so the gate is reproducible: a ruff minor release
can add rules that turn a previously clean tree red, so every machine
must lint with the same version.

Test modules relax E402 via per-file-ignores: they prepend src/ to
sys.path before importing wic, which trips the rule, and that ordering
is deliberate.

AI-Generated: codex/claude-opus 4.8 (xhigh)
Signed-off-by: Trevor Woerner <[email protected]>
---
changes in v4:
- expose linting through just recipes (lint-tests, lint) rather than
  run-tests.sh flags.
- pin ruff exactly (was a stale >= floor) so the clean-bar gate is
  reproducible across machines.
- fold in the tests/** E402 ignore (its own patch in v2 and v3) and
  drop the linting.md doc; the pyproject.toml comment explains it.
changes in v3:
- no change in this revision.
changes in v2:
- v1 submitted the entire test suite as a single commit; v2 breaks
  the work into a reviewable series, and this patch is one step of it.
---
 .gitignore     | 1 +
 justfile       | 9 +++++++++
 pyproject.toml | 8 ++++++++
 3 files changed, 18 insertions(+)

diff --git a/.gitignore b/.gitignore
index e30cafa40f7f..f2fd2f56b6d7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@
 .pytest_cache/
 .coverage
 htmlcov/
+.ruff_cache/
diff --git a/justfile b/justfile
index 1be3e01e7c7d..5ccd8144181d 100644
--- a/justfile
+++ b/justfile
@@ -16,3 +16,12 @@ coverage *args:
 # Run the suite with an HTML coverage report (written to htmlcov/).
 coverage-html *args:
     pytest {{args}} --cov=wic --cov-branch --cov-report=term-missing --cov-report=html
+
+# Lint the test suite; it is held to a clean bar, so this must be clean.
+lint-tests:
+    ruff check tests
+
+# Lint the test suite and then the wic source. src/ is not yet
+# ruff-clean, so its findings are a preview, not a gate.
+lint: lint-tests
+    ruff check src
diff --git a/pyproject.toml b/pyproject.toml
index 2ad694b13358..569944ff468c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -26,6 +26,7 @@ tests = [
     "pytest >= 9.1.1",
     "coverage >= 7.15.0",
     "pytest-cov >= 7.1.0",
+    "ruff == 0.15.20",
     "rust-just >= 1.55.1",
 ]
 
@@ -52,3 +53,10 @@ testpaths = ["tests"]
 # leftover directories under the pytest base temp directory.
 tmp_path_retention_policy = "failed"
 tmp_path_retention_count  = 1
+
+[tool.ruff.lint.per-file-ignores]
+# Test modules prepend the in-tree src/ directory to sys.path before
+# importing wic, so the suite runs against a checkout that has not been
+# installed. That bootstrap runs before the wic imports, which trips
+# E402; the ordering is deliberate, so ignore E402 for the test tree.
+"tests/**" = ["E402"]
-- 
2.50.0.173.g8b6f19ccfc3a