ci: two linters wearing the same name are not one gate

The local hook pinned ruff to v0.15.1. CI ran a bare `pip install ruff`
and got whatever astral had shipped that morning. Those are not the same
checker, so `just lint` passing locally said nothing about CI, and the
gap widened on astral's release schedule rather than on ours.

That is exactly how dlp-scanner went red: 0.16.0 stabilized PLR0917 out
of preview, CI adopted it unasked, and four signatures failed a rule the
local hook had never once run.

Pin CI to the rev in .pre-commit-config.yaml instead of hardcoding a
second version here. The hook rev is now the only place a ruff version
is written, so bumping it moves both sides in the same commit and the
two can no longer disagree. If that rev ever goes missing or stops
looking like a version, the step exits non-zero rather than falling
back to unpinned - both failure modes were tested.

Bump the pin 0.15.1 -> 0.16.1, which is the version CI was already
silently using. Censused first: all 18 ruff projects pass under 0.16.1,
and the freshly built hook env reports 0.16.1 at the binary and still
catches the original four errors in an unfixed tree.

.github/workflows/lint.yml

@@ -187,9 +187,27 @@ jobs:
       with:
         python-version: '3.12'
 
+    # Ruff is pinned to the rev in .pre-commit-config.yaml rather than
+    # hardcoded here, so bumping the hook bumps CI in the same commit.
+    # An unpinned `pip install ruff` silently adopts newly-stabilized
+    # rules and fails code the local hook just passed.
+    - name: Resolve pinned ruff version
+      if: matrix.type == 'ruff'
+      id: ruff_version
+      run: |
+        version=$(grep -A1 'astral-sh/ruff-pre-commit' \
+          "$GITHUB_WORKSPACE/.pre-commit-config.yaml" \
+          | grep -oP 'rev:\s*v\K[0-9]+\.[0-9]+\.[0-9]+')
+        if [[ -z "$version" ]]; then
+          echo "Could not resolve ruff rev from .pre-commit-config.yaml"
+          exit 1
+        fi
+        echo "Pinned ruff version: $version"
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+
     - name: Install ruff
       if: matrix.type == 'ruff'
-      run: pip install ruff
+      run: pip install "ruff==${{ steps.ruff_version.outputs.version }}"
 
     # Biome / Frontend Setup
     - name: Setup Node.js

.pre-commit-config.yaml

@@ -1,7 +1,10 @@
 repos:
   # Python Ruff Checks
+  # This rev is the single source of truth for the ruff version.
+  # .github/workflows/lint.yml reads it from this file so CI and the
+  # local hook can never lint with two different rule sets.
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.1
+    rev: v0.16.1
     hooks:
       # Beginner projects
       - id: ruff