Pin ruff exactly, matching the existing pyright pin rationale

CI installs the [build] extra fresh on every run, and ruff was the one
lint tool left unpinned. ruff 0.16.0 (released this week) began
flagging this codebase's str.format() house style, so every PR started
failing lint on lines it never touched. Pin to 0.15.21 — the version
the codebase is clean under — with the same bump-deliberately comment
pyright carries. Upgrading to 0.16 and converting to f-strings can be
its own PR.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pyproject.toml

@@ -91,7 +91,12 @@ build = [
     # stays on requests because its permissive-TLS fallback is built on
     # urllib3's HTTPAdapter machinery.
     "requests>=2.22.0",
-    "ruff",
+    # Pinned exactly for the same reason as pyright: ruff's default rule
+    # set evolves between releases (0.16.0 began flagging this codebase's
+    # str.format() style), so an unpinned version breaks CI without any
+    # code change. Bump deliberately and fix any new findings in the same
+    # PR as the bump.
+    "ruff==0.15.21",
     "sphinx",
     "sphinx_rtd_theme",
 ]