`make lint` runs ruff on src and tests directly on the host, using the
same invocation as the lint-python workflow so local and CI agree. The
script fails with a clear install hint when ruff is not on PATH.
`make test` now depends on `lint`, so linting runs before the container
images are built.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>