ci: pin ruff to pyproject version in lint workflow

[daryllimyt]

What

Pin the ruff version in lint-python.yml to the repo's pyproject.toml pin (ruff==0.15.0) via ruff-action's version-file input, replacing version: latest.

Why

ruff 0.16.0 was released today and version: latest picked it up immediately, turning the ruff check red on every open PR with new violations (I001, TRY201, UP035, RUF022, TRY004, BLE001) in pre-existing packages/tracecat-registry/ code that no PR touched. Verified locally:

• uv run ruff check tracecat/ tests/ packages/ alembic/ (0.15.0, the pyproject pin) — passes
• uvx ruff@0.16.0 check packages/tracecat-registry/ — fails with the same errors as CI

version-file: "pyproject.toml" keeps CI in lockstep with the dev/pre-commit pin, so future ruff upgrades happen deliberately via the pyproject.toml bump (with any new violations fixed in the same PR) instead of on ruff's release schedule.

Notes

• First seen on PR fix(agents): emit terminal stream END only after finalize_turn #3120 (ruff job failing on files outside the diff).
• No workflow triggers, permissions, or environments changed.

---

Summary by cubic

Pin ruff in lint-python.yml to the pyproject.toml version using ruff-action’s version-file, replacing version: latest, to prevent CI from breaking on new ruff releases. This keeps CI aligned with the dev/pre-commit pin and upgrades happen via the pyproject.toml bump.

^{Written for commit 5ebd77d. Summary will update on new commits.}

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 5ebd77d.

Security Overview

• 🔎 Scanned files: 1 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/00dffd6c-8834-4dc9-b6d8-b44cd1622986?scanId=00c589ae-cd95-465a-ad11-597c8e84e500&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Configuration changes	► .github/workflows/lint-python.yml     Update ruff-action version handling from "version" to "version-file" for lint and format steps