Chore: adopt the Sonar-adjacent ruff rule set vramfit and saucier run

[Alberto-Codes]

What Needs Maintaining

• Target: [tool.ruff.lint] extend-select in pyproject.toml
• Current version: ruff 0.16 defaults plus E402, E501, I, D
• Target version: the Sonar-adjacent set vramfit and saucier run: B, SIM, UP, RUF, PL, C901, TRY, PERF, S, G, with max-complexity = 12 and max-args = 7 to buffer under the SonarQube thresholds, and TRY003 ignored

Why Now

PR #432 synced the rest of the toolchain with vramfit and saucier but deliberately left the ruff rule set at the 0.16 defaults. The wider set is what lets a local ruff run cover the ground SonarQube would without a server, and both sibling repos already carry it. Accumulated drift: docvet is the only one of the three without it.

Expected Fallout

A trial run on main after #432 surfaces 602 findings. The bulk is a handful of rules:

Count	Rule	Note
188	PLC0415 import-outside-top-level	lazy imports in tests; vramfit ignores this for tests/**
144	PLR2004 magic-value-comparison	test assertions; vramfit ignores this for tests/**
45	RUF003 ambiguous-unicode-character-comment	em dashes in comments
34	S607 start-process-with-partial-path	["git", ...] and ["uv", ...] subprocess calls
18	PLR0913 too-many-arguments	typer commands take one arg per option; per-file ignore on the CLI modules like vramfit
15	TRY003 raise-vanilla-args	ignore globally, as the siblings do
11	PLW1510 / 10 C901 / 9 PLR0911	real complexity and subprocess hygiene, needs hand work

With the tests/** and CLI per-file ignores the siblings use, the count drops to roughly 130, most of them mechanical. The C901 and PLR0911 findings are the ones that need judgement; .claude/rules/sonarqube.md already targets CC 12 for the same functions.

Ordering to follow the rule-tightening playbook: config with the per-file ignores first, fix the mechanical set, then hand-fix complexity, then remove any temporary ignores.

Verification

• uv run pytest
• uv run ruff check . / uv run ruff format --check .
• uv run ty check
• uv audit
• uv run docvet check --all
• SonarQube scan on main after merge shows no new cognitive-complexity findings

---

BMAD Workflow

Maintenance work usually skips the story pipeline:

• /bmad-bmm-quick-spec -> /bmad-bmm-quick-dev for anything non-trivial
• Straight to a PR for routine bumps