deps: declare ruff + mypy in dev extra, pin via uv.lock

[Faerkeren]

Summary

Adds a dev optional-dependency group containing ruff and mypy so the tools invoked by AGENTS.md and CI are pinned and reproducible, instead of being installed ad-hoc on every CI run and every contributor machine.

Follow-up to the audit of prompts/ tooling requirements (#379 covered pip-audit).

Problem

AGENTS.md instructs contributors to run ruff check . and mypy, and CI runs the same. But neither tool was declared anywhere in pyproject.toml or uv.lock:

• CI workflows did python -m pip install ruff / mypy ad-hoc, pulling whatever version PyPI served at the moment.
• Contributors had to install them globally or via uvx separately.
• Result: lint/typecheck behaviour could drift between local + CI + over time.

Changes

pyproject.toml

New dev optional-dependency group:

dev = [
    "ruff>=0.15.0",
    "mypy>=1.18.0",
]

uv.lock

Regenerated. Adds ruff 0.15.14, mypy 2.1.0, mypy-extensions 1.1.0.

Workflows

• .github/workflows/python-lint.yml — removed python -m pip install ruff; default install-spec changed from .[test] to .[dev].
• .github/workflows/python-typecheck.yml — removed python -m pip install mypy; default install-spec changed from .[test] to .[dev,test] (mypy needs types-PyYAML from test).
• .github/workflows/ci.yml — passes dedicated install-specs:
  • py-lint → .[dev] (override via vars.CI_PYTHON_LINT_INSTALL_SPEC)
  • py-typecheck → .[dev,test] (override via vars.CI_PYTHON_TYPECHECK_INSTALL_SPEC)
  • py-build and py-test unchanged (still .[test] via CI_PYTHON_INSTALL_SPEC)

The reusable lint/typecheck workflows remain generic — they still take install-spec as an input, just no longer hardcode a tool install.

prompts/test-coverage-gap-review.md

Switched the prerequisite command from bare python -m pytest to uv sync --extra test + uv run python -m pytest, matching the style now used in dependency-health-review.md.

Verification

uv run ruff check .            \u2192 All checks passed!
uv run mypy src/deux/          \u2192 Success: no issues found in 67 source files
uv run python -m pytest tests/ --cov=deux --cov-fail-under=95
                               \u2192 1983 passed, 1 skipped; coverage 95.61%

Notes

• Not converting the reusable workflows wholesale to uv sync \u2014 they're designed to be repo-agnostic and pip-based. The minimal change here fully solves the unpinned-tooling problem without breaking that design.
• Two repo-level vars keys are introduced (CI_PYTHON_LINT_INSTALL_SPEC, CI_PYTHON_TYPECHECK_INSTALL_SPEC); both have safe defaults, no manual setup needed.