ci: use locked development tools in required checks

[Andyyyy64]

The CI setup has been drifting for a while, and I should've caught this sooner. Sorry it took me so long to clean it up.

Problem

The lint and test workflows install development tools directly from the package index instead of using the committed uv.lock.

The lint run for PR #147 installed Ruff 0.15.22 and passed. On 2026-07-29, Ruff 0.16.0 reports 100 findings against the same main branch. This means an unchanged commit can get a different required-check result depending on when CI runs.

The test workflow has the same problem with unbounded pytest and pyarrow installations.

Proposed change

• Declare Ruff in the development dependency group and record it in uv.lock.
• Make the lint and test workflows install development dependencies from the lockfile.
• Run Ruff and pytest through uv.
• Keep the contributor commands consistent with CI.

Acceptance criteria

• A fresh locked development sync succeeds on Python 3.11, 3.12, and 3.13.
• Locked Ruff check and format commands pass.
• The full test suite passes with locked dependencies.
• CI no longer installs unbounded Ruff, pytest, or pyarrow packages directly.
• uv lock --check succeeds after validation.

Out of scope

• Fixing or adopting the new Ruff 0.16 findings.
• Changing runtime dependency ranges.
• Changing the PyPI publishing workflow.
• Reformatting or refactoring application code.