ci: green again -- format and lint the whole tree; push the scan and runner images to GHCR on tags

CI and the release job check `ruff format --check .` and `ruff check .` over the
whole repository, while the local gate checked only src and tests, so eight
benchmark scripts drifted and the v2.0.0 release job stopped before building.
The fixes are formatting, two noqa comments and one renamed loop variable; no
script computes anything differently. The local gate now checks the whole tree.

The release workflow gains an images job: Dockerfile -> ghcr.io/<owner>/openultrasast,
plane/Dockerfile.runner -> ghcr.io/<owner>/openultrasast-runner, tagged with the
version, and the digests written to the job summary.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

benchmarks/dev/bulk_read.py

@@ -36,9 +36,9 @@ def main() -> int:
     parser.add_argument("files", nargs="+", type=Path)
     parser.add_argument("--max-usd", type=float, default=0.05)
     args = parser.parse_args()
+    from openultrasast import tool_hunter
     from openultrasast.config import load_config
     from openultrasast.model.endpoint import DEFAULT_DETECTOR_MODEL
-    from openultrasast import tool_hunter
 
     load_config()
     client = tool_hunter.resolve_hunter_client()
@@ -51,7 +51,12 @@ def main() -> int:
         if float(client.cost_usd()) >= args.max_usd:
             answers.append(f"[stopped at the ${args.max_usd} ceiling before: {chunk.splitlines()[0]}]")
             break
-        response = client.complete(model=DEFAULT_DETECTOR_MODEL, messages=[{"role": "user", "content": PROMPT.format(question=args.question, files=chunk)}], tools=[], timeout_seconds=90)
+        response = client.complete(
+            model=DEFAULT_DETECTOR_MODEL,
+            messages=[{"role": "user", "content": PROMPT.format(question=args.question, files=chunk)}],
+            tools=[],
+            timeout_seconds=90,
+        )
         answers.append((response.content or "").strip())
     print("\n\n".join(a for a in answers if a))
     print(f"\n[bulk_read: {len(chunks)} chunk(s), ${float(client.cost_usd()):.4f}]", file=sys.stderr)

benchmarks/dev/read_guard.py

@@ -37,7 +37,11 @@ def main() -> int:
         f"{path} has {lines} lines (limit {LIMIT} for a whole-file read). Read a range with offset/limit, or ask "
         f"the bulk reader for what you need: .venv/bin/python benchmarks/dev/bulk_read.py '<question>' {path}"
     )
-    print(json.dumps({"hookSpecificOutput": {"hookEventName": "PreToolUse", "permissionDecision": "deny", "permissionDecisionReason": reason}}))
+    print(
+        json.dumps(
+            {"hookSpecificOutput": {"hookEventName": "PreToolUse", "permissionDecision": "deny", "permissionDecisionReason": reason}}
+        )
+    )
     return 0