ci: add ruff lint gate + sweep tests/ lint debt; harden session-validation tests

[johnnichev]

Follow-up to #154. Two things: close the lint-enforcement gap, and finish the test polish #154 left behind.

Add ruff to CI

New lint job runs ruff check + ruff format --check on src/ and tests/, pinned to ruff 0.15.8 to match the ruff-pre-commit rev (no CI-vs-local drift). build now needs: [lint, test, security].

Why this matters: nothing was linting the whole tree. The pre-commit hook only sees changed files and ci.yml had no ruff step, so lint debt piled up invisibly. (This is also how #154 merged with lint violations — CI was green because CI didn't lint.)

Clear the pre-existing tests/ debt (required to turn the gate on)

src/ was already 100% clean. tests/ had 504 violations:

• 411 F401 unused-imports — removed the dead ones; the 45 intentional availability probes (from google.genai import types / import numpy inside try/except ImportError or skipif guards) get an explicit # noqa: F401 since deleting them breaks skip logic.
• 92 F841 unused-variables — dropped the dead bindings while preserving the side-effecting calls (result = agent.run(...) → agent.run(...)), verified against ruff's fix behavior.

Harden the #154 namespace tests

The four Supabase namespace-validation tests had been re-pointed at the module-level _validate_namespace in isolation, leaving an orphaned store local (the 4 F841s) and exercising no store path — so a future edit dropping the validator from _key would pass silently. Routed them back through store._key("sid", namespace=...), which asserts the wiring and removes the duplicate/unsorted import.

Verification

• ruff check src/ tests/ → All checks passed (under both 0.15.8 and 0.15.17)
• ruff format --check src/ tests/ → 418 files already formatted
• Full suite on 3.12: 7469 passed, 205 skipped, coverage 91.01% (gate 90%)

Scope: only tests/ + .github/workflows/ci.yml. src/ untouched.

https://claude.ai/code/session_01HQhq1HKYipPa6rjQAzffcg