The two ruff pins have drifted five minors apart, and pre-commit never runs in CI

[CameronBrooks11]

Found during an org-wide close-out sweep. This is the same pair of defects prusaslicer-py fixed in its #25, ported here because the shape is identical.

Measured

uv.lock resolves ruff        0.16.5      (from `ruff>=0.11` in the dev group)
.pre-commit-config.yaml rev  v0.11.12

Two different ruffs format and lint this repository. Nothing guarantees two builds five minors apart agree, and the cost of being wrong is the split this exists to prevent: git commit writes a diff that just check then rejects, and the failure reads as the contributor's mistake.

In the sibling repo the split was not hypothetical — the older ruff raised UP038 on that repo's own test file over a rule the newer one does not carry at all, so a contributor with hooks installed could not commit code CI accepted.

And nothing runs the hooks

grep -rl pre-commit .github/workflows/ returns nothing. So .pre-commit-config.yaml makes a claim this repository does not keep for anyone who has not run pre-commit install — and --no-verify skips it for those who have.

This repo also has no gitleaks hook at all, unlike its siblings. GitHub's own secret scanning and push protection are enabled here, so this is not an uncovered gap, but it is an inconsistency worth a deliberate decision rather than an accident.

What the fix looked like elsewhere

Three parts, and the middle one is the part that is easy to get wrong:

1. Both pins exact and equal, held by a test, so bumping one alone fails here instead of drifting quietly.
2. Running the hooks in CI is not the same as the hooks checking anything. Three of the eight hooks in the sibling repo were no-ops even once CI ran them — the stock gitleaks hook is --staged, which scans zero bytes on a CI checkout; check-added-large-files intersects with newly staged files; check-merge-conflict returns 0 unless mid-merge. Each needed a flag or a second invocation before it could fail at all. If this repo adds a CI job, plant a defect for every hook and watch each go red first.
3. Dependabot then keeps the revs current — added in ci: watch the action, uv and pre-commit pins #29.

Not urgent

Nothing is broken today: CI is green, just check passes, and GitHub-side secret scanning is on. This is drift that will bite whoever next runs pre-commit install.