Stabilize CI tooling versions

[astrojaket]

Root cause

The quality job installed Ruff 0.16.3 from the open ruff>=0.11 dependency. That release changed the effective default lint rules and exposed 347 historical style findings. All Python matrix and opacity jobs passed.

Fix

• pin Ruff to the last known-good CI version, 0.15.22
• define the lint rule set explicitly so future Ruff defaults cannot expand CI policy
• update checkout and setup-python to their current Node.js 24-based v7 releases
• add regression tests for the tool pin, lint rules, and action versions

Local validation

• Ruff 0.15.22: passed
• full suite with CPU JAX backend: 498 passed, 1 skipped
• coverage: 74% (70% required)
• source distribution and wheel build: passed
• git diff --check: passed