ci: pin ruff and fix lint so master validates again

CI installed an unpinned ruff, so a new ruff release (UP017, B905) has
failed every master and PR run since 2026-09-16. Pin ruff in the dev
lock (upgrades now arrive via dependabot) and fix the three findings
without changing behavior.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Author: xxg1413

.github/workflows/validate.yml

@@ -36,7 +36,7 @@ jobs:
       - name: Install dependencies and dev tools
         run: |
           uv venv --python ${{ matrix.python-version }}
-          uv pip install -r requirements-dev.lock.txt ruff
+          uv pip install -r requirements-dev.lock.txt
 
       - name: Lint with ruff
         run: .venv/bin/ruff check .

requirements-dev.lock.txt

@@ -9,6 +9,7 @@ Pygments==2.21.0
 pytest==9.1.1
 referencing==0.37.0
 rpds-py==2026.6.3
+ruff==0.16.9
 contourpy==1.4.0
 cycler==0.12.1
 fonttools==4.65.0

tools/claim_receipt.py

@@ -17,7 +17,7 @@
 import hmac
 import json
 import secrets
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from pathlib import Path
 
 SECRET_ENV = "FLYPYTHON_CLAIM_SECRET"
@@ -85,7 +85,7 @@ def make_receipt(
         },
         "impl_sha256": impl_hash,
         "solution_match": (impl_hash == solution_hash) if solution_hash else False,
-        "created_at": datetime.now(timezone.utc).isoformat(timespec="milliseconds").replace("+00:00", "Z"),
+        "created_at": datetime.now(UTC).isoformat(timespec="milliseconds").replace("+00:00", "Z"),
         "nonce": secrets.token_hex(16),
     }
     receipt["sig"] = hmac.new(

tools/verify_courses.py

@@ -376,8 +376,9 @@ def check_shared_core(courses: list[Path]) -> list[str]:
             shapes.append(list(zip(
                 re.findall(r'"id":\s*"(l\d+|capstone)"', verify),
                 re.findall(r'"gate":\s*"([a-z-]+)"', verify),
+                strict=False,
             )))
-        for member, shape in zip(members[1:], shapes[1:]):
+        for member, shape in zip(members[1:], shapes[1:], strict=True):
             if shape != shapes[0]:
                 problems.append(
                     f"core-group {group}: {member.name} checkpoint ids/gates differ from {members[0].name}"