fix(ci): pin ruff in pyproject for Dependabot and fix its target so local and CI lint agree

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: daily

.github/workflows/test.yml

@@ -24,7 +24,8 @@ jobs:
 
       - name: 📦 Install lint tools
         run: |
-          pip install ruff
+          python -m pip install --upgrade pip
+          pip install --group lint
           sudo apt-get update && sudo apt-get install -y shellcheck
           npm install -g markdownlint-cli2
 

.github/workflows/update.yml

@@ -29,7 +29,8 @@ jobs:
 
       - name: 📦 Install lint tools
         run: |
-          pip install ruff
+          python -m pip install --upgrade pip
+          pip install --group lint
           sudo apt-get update && sudo apt-get install -y shellcheck
           npm install -g markdownlint-cli2
 

pyproject.toml

@@ -0,0 +1,5 @@
+[dependency-groups]
+lint = ["ruff==0.17.3"]
+
+[tool.ruff]
+target-version = "py312"

skills/democracy/scripts/council.py

@@ -89,7 +89,7 @@ def write_claim(path: Path, office: str, sid: str, runtime: str, work: str) -> N
         "session": sid,
         "runtime": runtime,
         "name": live_sessions().get(sid),
-        "since": datetime.datetime.now(datetime.timezone.utc).isoformat(timespec="seconds"),
+        "since": datetime.datetime.now(datetime.UTC).isoformat(timespec="seconds"),
         "beat": time.time(),
         "work": work,
     }