master is red: ruff, a to_dict() lost in a replay, vendored drift, Scorecard, yamllint on Windows #140

Symptom

CI — ebuild has been red on master since 09-08, and because the first failing step is ruff, mypy and pytest have not run on master since. Vendored core drift and OSSF Scorecard are red on the same commit for unrelated reasons.

Verified on 8b623d5

• ruff: F811 duplicate import shutil, W292 missing trailing newline, E402 ×2 (imports two hundred lines into tests/unit/test_ci_gate.py).
• mypy (once ruff passes): ebuild/packages/index_sync.py:354 calls PackageRecipe.to_dict(), which feat: implement package management system with recipe support, regist… #111 defined and fix(packages): validate recipe list fields #112 — merged five minutes later from a base without it — deleted in its replay. Nine test_index_sync cases fail with AttributeError. On 3.10/3.11 ebuild/plugins/__init__.py:46 also fails type-checking.
• Vendored drift 44 → 45: fix: derive SDK toolchain from detected profile #109 edited core/eos/docs/three-way-alignment.md, a snapshot pinned to eos 5544c98.
• Scorecard: ossf/scorecard-action@v2.4.0 pulls gcr.io, which now refuses with "requires billing to be enabled".
• yamllint has never passed on the Windows legs (added 09-03; the runner's core.autocrlf=true turns LF into CRLF).

Fix

#132.