chore(ci): add ruff to pre-push hook and Makefile

Add Python/ruff block to .config/hooks/pre-push (runs on tooling/
changes). Add lint-python and setup-venv Makefile targets, wire
both into make lint and make setup respectively.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.config/hooks/pre-push

@@ -14,10 +14,12 @@ REMOTE_REF="origin/$BRANCH"
 if git rev-parse --verify "$REMOTE_REF" >/dev/null 2>&1; then
     CLIENT_CHANGED=$(git diff --name-only "$REMOTE_REF"..HEAD -- client/ 2>/dev/null | wc -l)
     SERVER_CHANGED=$(git diff --name-only "$REMOTE_REF"..HEAD -- server/ 2>/dev/null | wc -l)
+    TOOLING_CHANGED=$(git diff --name-only "$REMOTE_REF"..HEAD -- tooling/ pyproject.toml 2>/dev/null | wc -l)
 else
     # New branch or no remote ref — fall through to directory checks
     CLIENT_CHANGED=1
     SERVER_CHANGED=1
+    TOOLING_CHANGED=1
 fi
 
 # --- GDScript parse check (headless Godot) ---
@@ -97,6 +99,20 @@ else
     echo "pre-push: WARNING — cargo not found or server/ missing, skipping Rust lint"
 fi
 
+# --- Python lint (ruff) ---
+if [ "$TOOLING_CHANGED" -eq 0 ]; then
+    echo "pre-push: no tooling/ changes — skipping Python lint"
+elif command -v ruff >/dev/null 2>&1 && [ -d "$REPO_ROOT/tooling" ]; then
+    echo "pre-push: checking Python (ruff)..."
+    if ! (cd "$REPO_ROOT" && ruff check tooling/ 2>&1); then
+        ERRORS=$((ERRORS + 1))
+    else
+        echo "pre-push: ruff — OK"
+    fi
+else
+    echo "pre-push: skipping Python lint (ruff not found — install with: pip install 'ruff>=0.9')"
+fi
+
 if [ "$ERRORS" -gt 0 ]; then
     echo ""
     echo "pre-push: $ERRORS check(s) failed. Push aborted."