Pin ruff and fix lint for the 0.16 default rule-set expansion

[AkshitaB]

Summary

ruff was unpinned in pyproject.toml. Ruff 0.16.0 nearly doubles the default enabled rule set (115 → 199 rules for a typical file), and since CI installs dependencies via uv pip install -e .[all] rather than uv sync, it silently picked up 0.16.0 and started failing lint across the repo with ~5,400 new violations.

• Pin ruff>=0.16.0,<0.17 and regenerate uv.lock so a future release can't silently break CI again.
• Fix the resulting violations: mostly mechanical typing.Dict/List/Optional → builtin generics and similar modernization, plus a smaller set of hand-fixed items (merged nested ifs, a few ValueError/RuntimeError → TypeError where the raise is a genuine type-dispatch failure, dead global declarations, redundant exception logging, a real late-binding closure bug in a test, a docstring that was accidentally an f-string, a mutable-default-argument fix, and file-permission mismatches on 5 scripts).
• Add two documented rule ignores rather than degrade existing intentional patterns:
  • BLE001 — this codebase intentionally catches broad exceptions in checkpoint/cleanup/resilience paths.
  • I001 — import order is already owned by isort (make style-check); ruff's own sorter disagreed with isort on one test.* edge case.
• Left tempfile.NamedTemporaryFile(delete=False) and naive datetime.now()/.today() call sites as-is with per-line noqa where they're deliberate (manual temp-file lifecycle, human-facing local-time display) rather than rewriting working code to satisfy a new rule.

Test plan

• isort --check ., black --check ., ruff check ., mypy src/ all pass
• Full CPU test suite: 567 passed, 200 skipped, 1 pre-existing failure (test_gcs_functionality, requires live GCS credentials only available via CI secrets) unrelated to this change