chore: bump CI actions and dependencies, widen ruff rule set, drop bandit

[smarlhens]

Summary

#	Commit	What
1	94574e9	actions/setup-python v6 → v7, astral-sh/setup-uv v8.2.0 → v9.0.0
2	6b13bbf	pre-commit hooks + Python deps + uv lock --upgrade
3	00e6cba	Dedupe extend-select against ruff v0.16 defaults, widen rule set
4	8ee802a	Replace bandit with ruff's S ruleset

1. GitHub Actions

actions/setup-python v7.0.0

• Migrated to ESM, dependencies upgraded (@actions/cache 6.2.0)
• Removed the pip-install input — not used here, no impact
• stderr warnings are now annotated as warnings instead of errors
• Manifest fetch is validated and retried to prevent silent failures

astral-sh/setup-uv v9.0.0

• Breaking: prune-cache default changed to false (Change prune-cache default to false astral-sh/setup-uv#967) to reduce load on PyPI infrastructure. This can increase GitHub Actions cache usage.
  Both jobs already run an explicit uv cache prune --ci step before the cache-save post step, so effective pruning behaviour is unchanged.
• Fix: fall back to distribution ID when os-release has no version field
• Faster version resolution via partial manifest reads

2. Hooks and dependencies

ruff v0.15.20 → v0.16.0, mypy v2.1.0 → v2.3.0, ty v0.0.55 → v0.0.63, oxfmt v0.56.0 → v0.60.0, with matching floors in [dependency-groups] dev.

ruff v0.16.0 breaking changes

• The default rule set grew from 59 to 413 rules. Because [tool.ruff.lint] uses extend-select, the effective rule set silently widened from E4,E7,E9,F + our curated list to all 413 defaults + our curated list. Addressed in commit 3.
• ruff format now formats Python code blocks in Markdown. Inert here: CI formats only src tests, the ruff-format hook is scoped to types_or: [python, pyi, jupyter], and README.md has no python fences. Opt out with extend-exclude = ["*.md"] if that changes.
• New # ruff: ignore[RULE] / # ruff: file-ignore[RULE] suppression comments alongside noqa
• format --check gained the linter output formats (github, gitlab, …) and now shows the diff
• JSON output filename / location / end_location may now be null

Note: pre-commit autoupdate resolves mirrors-oxfmt to v0.45.0 (a stale tag on the default branch), which is a downgrade. Pinned to v0.60.0 manually.

3. Ruff rule set: dedupe + widen

Each selector was expanded in isolation via ruff check --isolated --config 'lint.select=[…]' --show-settings and compared against the 413-rule default set.

Removed as redundant — every rule they select is now on by default:

D419  G010  PERF101  PERF102  PERF402  PGH005  PIE794  PIE796  PIE807  PIE810
RUF015  RUF032  RUF033  RUF034  RUF041  RUF046  RUF057  RUF059  RUF100

Collapsed into wider selectors (a widening, not a removal):

was	now	net
N805	N	+14 pep8-naming
PLC, PLR	PL	+PLE (8), +PLW (8)
RET502–RET505	RET	+RET506/507/508

Newly enabled: A, ANN401, ARG, B, D417, EM, ERA001, FBT, G, ISC003, LOG, PERF403, PGH003, PT, PTH, RSE102, RUF005, RUF006, RUF021, RUF036, SIM, SLF001, SLOT, TC, TID252, TRY300, TRY301, TRY400.

Deliberately excluded: COM812/ISC001/Q (conflict with the formatter), D203/D212 (mutually exclusive with the configured D211/D213), TD/FIX, C901 (needs a threshold; PLR0912 covers it), and the framework rulesets (AIR, DJ, PD, NPY, FAST).

Net: 59 → 64 selectors, 494 → 639 rules enabled, zero rules lost.

tests/test_python_boilerplate.py now uses assert instead of raise ValueError(...). EM101 flagged the string literal in the raise; assert is the idiomatic pytest form and S101 is already in per-file-ignores for tests.

4. Bandit parity

Enumerated bandit 1.9.4's registry (75 test ids across plugins and blacklists) against ruff's 73 flake8-bandit rules. Numeric ids map 1:1 (S608 ↔ B608).

• 71 shared, of which 13 are preview-gated in ruff (S401–S415, the import blacklists) and so inert without preview = true
• ruff-only: 2 — S320, S410, both Removed status
• bandit-only: 4 — B613, B614, B615, B703

Two of those four are covered under different ids: B703 (django mark_safe) by S308, and B613 (trojansource) by PLE2502 bidirectional-unicode, now enabled via PL.

Effective coverage: 58/75, confirmed against --show-settings (58 S rules enabled, 693 rules total). Remaining gaps are B614 (torch.load) and B615 (unsafe HuggingFace download) — no ML dependencies in this template — plus the 13 preview-gated import blacklists.

Given that, bandit is replaced by S: one fewer dev dependency (and 4 transitives: pbr, pyyaml, rich, stevedore), one fewer pre-commit hook, one fewer CI step. S also covers tests/, which the bandit hook excluded via exclude: ^tests/.

Verification

pre-commit run --all-files passes locally at every commit; CI green on all four.