lint.yml: repo is not ruff-clean (gate newly unblocked)

[Jammy2211]

Context

The lint.yml gate had been failing at the Install lint tools step since ~2026-06-07 — the lychee release tarball started nesting its binary under lychee-x86_64-unknown-linux-gnu/, so tar -xz -C /usr/local/bin lychee errored with lychee: Not found in archive and ruff never ran.

That install step is now fixed (PR #49: --strip-components=1 lychee-x86_64-unknown-linux-gnu/lychee). With ruff finally running, the repo's own Python turns out to have never been lint-clean. This issue tracks bringing it to green.

ruff check . violations (~300)

Count	Rule	Notes
105	I001	unsorted imports — ruff check --fix
99	E402	import-not-at-top — intentional: scripts sys.path.insert(...) before importing the sibling _profile_cli helper. Should be ignored via config, not reordered.
28	B905	zip() without strict=
21	F541	f-string without placeholder — auto-fixable
20	B007	unused loop variable
14	UP045	Optional[X] → `X
8	F401	unused import — auto-fixable
~10	UP007 / E401 / …	mixed

lint.yml also runs ruff format --check ., which will require running ruff format . across the Python tree (large but mechanical diff).

Suggested approach

1. Add a [tool.ruff] config with extend-ignore = ["E402"] (or a per-file-ignore scoped to the script dirs that manipulate sys.path).
2. ruff check --fix . for the auto-fixable rules; hand-resolve B905 / B007 / E401.
3. ruff format . to satisfy the format gate.
4. Confirm lint.yml is fully green, then close.

Separated from the docs-consolidation PR (#49) to keep that change docs-only and let the lint-policy decisions (E402, format) be made deliberately.