ci(lint): pin ruff in both jobs and clear the two RUF errors it reports on main

.github/workflows/ci.yml

@@ -19,7 +19,10 @@ jobs:
           python-version: "3.11"
 
       - name: Install ruff
-        run: pip install ruff
+        # Pinned on purpose: an unpinned install makes Lint a moving target. ruff 0.16.0
+        # started reporting RUF100/RUF036 on files nobody had touched, so `main` and every
+        # open PR went red on the same day without a single line of code changing.
+        run: pip install ruff==0.16.0
 
       - name: Run ruff check
         run: ruff check src/ tests/
@@ -106,7 +109,10 @@ jobs:
           python-version: "3.11"
 
       - name: Install ruff
-        run: pip install ruff
+        # Pinned on purpose: an unpinned install makes Lint a moving target. ruff 0.16.0
+        # started reporting RUF100/RUF036 on files nobody had touched, so `main` and every
+        # open PR went red on the same day without a single line of code changing.
+        run: pip install ruff==0.16.0
 
       - name: Run security rules
         run: ruff check src/ --select S --ignore S101,S110,S112,S311,S324

src/surreal_memory/mcp/version_check_handler.py

@@ -211,7 +211,7 @@ def _blocking_fetch() -> str | None:
         try:
             if not _PYPI_URL.startswith("https://"):
                 return None
-            req = urllib.request.Request(  # noqa: S310
+            req = urllib.request.Request(
                 _PYPI_URL,
                 headers={"Accept": "application/json"},
             )

tests/unit/test_version_check.py

@@ -84,7 +84,7 @@ def test_editable_hint_for_dev_install(self) -> None:
 def _make_handler(
     *,
     update_available: bool = False,
-    version_info: VersionInfo | None | str = "auto",
+    version_info: VersionInfo | str | None = "auto",
 ) -> MagicMock:
     """Create a mock handler with VersionCheckHandler.get_update_hint."""
     from surreal_memory.mcp.version_check_handler import VersionCheckHandler