build(lint): select ruff's rules explicitly instead of inheriting them

The gate had no `select`, so it linted with whatever the installed ruff
version defaults to. `dev` pins only `ruff>=0.6` and CI installs that
extra fresh on every run, which made the rule set a function of when pip
last resolved rather than of this code. Two developers on one commit
could get different answers, and so could CI and a laptop.

This surfaced when T-47's converged setup reinstalled ruff and pulled
0.16.3: `make lint` failed on UP017 and BLE001 in main.py, a file the
commit before it had not touched. Under the previous install the same
code passed. Nothing about the code changed — only the linter's idea of
what to look at, which had grown to 413 rules with nobody choosing them.

Naming the families fixes that; pinning the version would only have
frozen the symptom and moved the surprise to whoever unpinned it. 217
rules now, selected on purpose, and a future ruff release becomes a
decision instead of a broken push.

ASYNC is included deliberately — this is a websocket gateway, and it is
the family whose findings would be real bugs rather than style. BLE is
deliberately excluded: main.py catches bare Exception when a device
disappears mid-send, which is correct there, and selecting BLE would
mean a noqa on every such site to say so.

UP017 is fixed rather than suppressed (datetime.timezone.utc -> UTC,
identical semantics, and requires-python is already >=3.11); isort then
reordered the import, which is the whole of the main.py diff.

Verified the selection is load-bearing rather than decorative: a probe
file with a mutable default argument fails the explicit set (B006, exit
1) and passes ruff's minimal default set (exit 0), so the rules named
here are doing work the fallback would not. Probe deleted; lint,
typecheck and the 9-test suite all green after.

Co-Authored-By: Claude <noreply@anthropic.com>

gateway/pyproject.toml

@@ -33,6 +33,28 @@ where = ["src"]
 line-length = 100
 src = ["src"]
 
+# Selected explicitly, because the default set is not a constant.
+#
+# With no `select` here, ruff lints with whatever its installed version
+# defaults to — 413 rules under 0.16.3. `dev` pins only `ruff>=0.6`, and CI
+# installs that extra fresh on every run, so the gate's scope was a function of
+# when pip last resolved rather than of this code. Two findings appeared here
+# the first time a converged environment ran the gate, in a file nobody had
+# touched (T-47).
+#
+# That is the failure this repo keeps meeting from the other side: a check
+# whose result depends on something other than the thing it checks. Pinning the
+# ruff version would freeze the symptom; naming the rules fixes it, and makes
+# a future ruff release a decision rather than a surprise.
+#
+# ASYNC is here on purpose — this is a websocket gateway, and it is the one
+# family whose findings would be genuine bugs rather than style.
+# BLE (blind except) is deliberately absent: main.py catches bare Exception
+# when a device disappears mid-send, which is correct there and would need a
+# noqa on every occurrence to say so.
+[tool.ruff.lint]
+select = ["E", "W", "F", "I", "UP", "B", "ASYNC", "SIM", "C4"]
+
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
 testpaths = ["tests"]

gateway/src/desklock_gateway/main.py

@@ -7,7 +7,7 @@ Protocol (see docs/architecture.md — keep in sync):
 
 import asyncio
 import logging
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 
 from fastapi import FastAPI, WebSocket, WebSocketDisconnect
 
@@ -41,7 +41,7 @@ async def _ensure_filler() -> bytes | None:
 
 
 def _now() -> str:
-    return datetime.now(timezone.utc).astimezone().isoformat(timespec="seconds")
+    return datetime.now(UTC).astimezone().isoformat(timespec="seconds")
 
 
 @app.get("/healthz")