fix: clear ruff 0.16 findings and bound the linter version

[abrichr]

CI was red on 375 ruff errors with no code change behind them. main has not
been touched since 2025-04-06; the cause is an unpinned linter. Dev deps ask
for ruff>=0.11.2, this project selects no rules explicitly (the [tool.ruff]
block was entirely commented out), and ruff 0.16.0 grew its DEFAULT rule set
from 59 rules to 413. Verified directly against this tree:

ruff 0.11.2 check: All checks passed! format: 29 files already formatted
ruff 0.14.0 check: All checks passed! format: 29 files already formatted
ruff 0.16.0 check: Found 375 errors. format: 2 files would be reformatted

Fixed in code (285)

• UP006/UP045/UP007/UP035 (231) - List/Dict/Type -> builtins,
  Optional[X] -> X | None. requires-python is >=3.10.
• I001 (28) - import ordering.
• SIM201 (4), SIM102 (2), SIM114 (1), C414 (2), FURB188 (2), UP024 (4),
  RUF010/RUF019/RUF059 - mechanical simplifications.
• ruff format (7 files) - 0.16 also formats Python blocks inside Markdown,
  which is why CLAUDE.md and docs/testing_strategy.md move. Whitespace only.

Fixed as real defects (6)

• PIE794 config.py - OMNIPARSER_DOWNSAMPLE_FACTOR was declared twice, the
  second time with Field(ge=0.1, le=1.0). The bare = 1.0 above it was dead
  and silently shadowed. Removed the dead one; the ge/le constraints and the
  1.0 default are confirmed intact on the loaded settings object.
• B006 server.py - ports: list[int] = [22, config.PORT] was a shared mutable
  default. Now None, resolving to a module-level tuple that is still built at
  import exactly as before, so config.PORT is read at the same moment.
• RUF012 input.py - _special_map_definitions is only ever read via
  InputController., so it is now a ClassVar. 43 entries, unchanged.
• S110 server.py - the SSH readiness probe caught everything and passed, so a
  wrong key path was indistinguishable from "instance still booting". It now
  logs at debug. Retry behaviour unchanged.
• PLW1510 server.py - subprocess.run(..., check=False) states the existing
  behaviour rather than changing it.
• EXE001 - cli.py and run_omnimcp.py carry shebangs and are entry points
  (cli.py --help is the CI smoke test); the executable bit is now set.

DTZ005/DTZ006 (3), fixed without changing behaviour

• agent_executor run directory name must stay LOCAL wall clock - users
  correlate run folders with their own clock. now(utc).astimezone() is the
  same instant with the same rendering; asserted byte-identical.
• server end_time is only consumed via .timestamp(), where naive-local and
  UTC-aware produce the identical epoch. Pure disambiguation.
• CloudWatch event rendering now says UTC explicitly. This does change the
  printed string, deliberately: it was previously an unlabelled local time
  printed next to AWS's own UTC timestamps.

Disabled deliberately (85)

BLE001 is ignored in [tool.ruff.lint], with the reasoning inline in
pyproject.toml, rather than suppressed at 85 sites with # noqa. OmniMCP is a
computer-use agent and essentially every one of those handlers wraps a call
into something outside the process - pynput's platform backends, mss, PIL, the
Anthropic API, an OmniParser HTTP server, boto3/EC2, paramiko - and each logs
and degrades so one flaky OS or network call cannot kill an agent run. Those
libraries share no exception hierarchy and several raise platform-specific
backend errors outside any published API, so enumerating them would silently
reintroduce crash-on-first-surprise. That is a behaviour change, not a style
change.

Also bounded ruff to >=0.16,<0.17 so the next default-rule expansion is an
explicit decision instead of a surprise red CI.

Verified with the exact CI sequence: ruff check . clean, ruff format --check . clean, pytest tests/ 19 passed 1 skipped (identical to the
pre-change baseline), python cli.py --help OK.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NyCHrzA1psrKMFfroYbzaM