Modernise linting and formatting toolchain

The current pre-commit stack has three overlapping tools (black, isort, flake8) where one would do. Ruff covers all three, runs faster, and opens up rule categories we currently have no coverage for.

Replace black + isort + flake8 with ruff

Ruff is a drop-in replacement for all three. The [tool.black], [tool.isort], and [tool.flake8] sections in pyproject.toml go away and get replaced with a single [tool.ruff] block. The pre-commit hooks reduce from three entries to one.

Enable additional rule categories

With ruff in place it's easy to turn on rules we currently have no coverage for:

• S - bandit security rules. Would have caught the shell=True subprocess bug fixed in v0.6.0
• PT - pytest anti-patterns, directly relevant given the ongoing test work
• PTH - prefer pathlib over os.path, the codebase mixes both
• UP - modernise Python syntax across supported versions
• G - logging format, relevant since switching to loguru
• TCH - move type-only imports into TYPE_CHECKING blocks

These can be introduced with ignore entries for anything not ready to enforce immediately and tightened over time.

Add small pre-commit hooks

• pyproject-fmt - keeps pyproject.toml consistently formatted
• python-check-blanket-noqa - requires a specific code on every # noqa comment
• no-commit-to-branch - prevents accidental direct commits to main