Add ruff as a linter and fix the first batch of findings

[zoahdev]

Why

KineGrant has no enforced linter yet, so small style and quality issues can slip in. A linter also strengthens the OpenSSF Best Practices warnings criterion.

Scope

1. Add ruff to a new lint extra in [project.optional-dependencies] and pin it.
2. Add a CI step in .github/workflows/ci.yml that runs ruff check src tests.
3. Run ruff locally, fix only safe/mechanical findings (unused imports, undefined names, obvious formatting), and make the CI step green.
4. Do not change runtime behavior or rename public APIs.

Acceptance

• ruff check src tests exits 0.
• CI lint step passes on Python 3.12.
• No functional test changes unless required by the fixes.