fix(QUAL-008): pin the pre-commit ruff hook to the version CI installs

[DoRmAmMu1997]

The drift

.pre-commit-config.yaml pinned ruff-pre-commit at v0.15.1 while constraints.txt pinned ruff==0.16.3 — a full minor version apart, with real rule differences.

The config file asked for these to stay aligned, in a comment on the line directly above the rev:

  - repo: https://github.com/astral-sh/ruff-pre-commit
    # Keep this rev aligned with the ruff pin in constraints.txt.
    rev: v0.15.1

Nothing enforced it, so it drifted. A commit-time hook that lints with different rules than CI can pass code CI then rejects — which defeats the purpose of having the hook at all.

Why the existing guard missed it

tests/test_supply_chain_policy.py is exactly the right place for this — it already asserts the verbatim CI command strings and the constraints.txt pin list. But it checked:

• the hook ids, the files regex, and the no---fix policy (:145)
• separately, that a ruff== pin exists in constraints.txt (:191)

...and never compared the two values. The one cross-file invariant the config explicitly asked for was the one nobody guarded.

The fix

• Bump the hook to v0.16.3 (tag confirmed upstream at 65dbdb5).
• Add test_pre_commit_ruff_rev_matches_the_constraints_pin: parses the ruff-pre-commit rev, parses the ruff== pin, requires equality.
• Add a companion test_pre_commit_ruff_rev_guard_rejects_a_drifted_pin, matching the file's existing pattern of proving each guard actually bites (same shape as the QUAL-007 ignore_errors pair).

Verification

• Re-drifted the rev to v0.15.1 and confirmed the new assertion fails with - 0.16.3 / + 0.15.1, then restored it.
• python -m ruff check app.py backend screeners ui Dependencies tests passes under 0.16.3, so the bump surfaces no new findings.
• pytest -q --cov=... --cov-fail-under=89 — 2036 passed, 1 skipped, 89.96%
• pre_commit validate-config (the command CI runs) passes.
• git diff origin/main HEAD -- constraints.txt pyproject.toml — empty.
• origin/main merged in and gates re-run after PRs fix(DATA-003): stop the scan re-dirtying the candle cache it just repaired #112/fix(DATA-004): stop re-downloading stocks that listed after the window opened #114 landed.

Note: pre-commit run --all-files cannot execute on the development machine — it fails to clone its hook environments (InvalidManifestError) on untouched main too, so it is a pre-existing local environment issue rather than anything this PR introduces. CI runs only validate-config, which passes. Lint was verified directly with python -m ruff check, which is what the hook shells out to anyway.

🤖 Generated with Claude Code