ci: gate on ruff's default rules, and clear the nine findings

[imran-siddique]

Closes the last actionable item in #77.

The nine findings, and where they came from

Eight of nine were introduced the same day, by the WCM integrations: imports that became unused when those modules switched to the SDK's artifact_digest, and typing leftovers from threading annotations through.

integrations/wcm-coco-trustee/wcm_coco.py:49    F401 typing.Any
integrations/wcm-cyclonedx/wcm_cyclonedx.py:44  F401 wcm.BaseConfidentiality
integrations/wcm-huggingface/wcm_hf_guard.py:42 F401 hashlib
integrations/wcm-opentelemetry/wcm_otel.py:47   F401 typing.Callable, typing.Iterator
integrations/wcm-triton/wcm_triton.py:50        F401 hashlib
integrations/wcm-vllm/wcm_serving_guard.py:85   F401 typing.Optional, typing.Sequence
integrations/otel-genai/test_otel_to_trace.py:11 F401 json      (pre-existing)

They were tested and never linted, because nothing lints this repository. That is the gap a gate closes and a code review does not.

Scope: default rules only, on purpose

E4, E7, E9, F catches defects rather than preferences: undefined names, unused imports, f-strings with no placeholders, duplicate arguments.

Wider selections (UP, I, ANN, D, FA) are style, and several integrations here are contributed by their vendors under CONTRIBUTING rule 5, "You maintain it". Failing somebody's PR on import sorting is how a self-serve submission path stops being self-serve. A wider set, if wanted, should arrive with its own fix pass rather than being switched on for the next contributor to discover.

#77's numbers will not reproduce, and that is worth knowing

A bare ruff check on my machine reports 128 findings in the three directories the issue names, not 21. The reason is that ruff resolves configuration from outside the repository when the repository carries none, so the effective rule set depends on whose machine runs it. Against the default set those same directories are clean.

The gate pins ruff==0.16.3 and states its selection explicitly, so the number means the same thing everywhere.

Paths are listed rather than ., so a vendored or generated tree added later does not silently join the gate. .nox/ is already excluded by ruff's defaults, which matters here because it holds installed site-packages.

Rest of #77

Verified separately and reported on the issue: the stack-trace exposures were fixed in #132, the ruff errors in sentinel/comply54 in #137, and every GitHub action and the sentinel Dockerfile base image are digest-pinned. Unpinned pip install remains and is arguably deliberate, since the conformance workflows exist to test against current releases.

401 tests pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_014NL8o3PXq6kfs2SdmBv6ak