fix(ci): run ruff format, and record run 5 at 90% pair-correct

CI was red on `ruff format --check`: 23 files. I ran `ruff check` after every
change this session and never once ran `ruff format --check`, though CI runs
both. Lint passing is not formatting passing, and I treated one as evidence for
the other for the whole session.

Formatting applied. The full CI sequence now reproduces locally: format, lint,
mypy over 94 files, 735 tests, three gates byte-identical, compileall, and the
semantic job's 16 marked tests.

Also records run 5 of the pipeline measurement, which the vampi fix lifted as
predicted:

                       hunter (K=5)   pipeline (K=1)
  pair-correct              76.7%          90.0%
  leak                      12.3%           6.7%
  detection                    --          96.7%
  cost                     ~$0.69        $0.0068

27 of 30 pairs. Five runs, each step from a measurement contradicting an
assumption: 73.3 (no pipeline path) -> 73.3 (routing fixed, IDENTICAL, which
exposed the discarded verdict) -> 80.0 (residual question matched to its
arbiter) -> 86.7 (aiohttp settings) -> 90.0 (dominance question no longer
contradicting its own evidence).

One miss left: dsvpwa-dsvpwa-main, whose setting is an argparse --ssl default
rather than a security-setting call. Out of reach before the settings work and
still is; contorting the arbiter around one pair would be worse than the miss.

The caveat is recorded beside the number: 30 pairs of one slice, and the slice
iterated against all session. The +16% overfitting gap against vfc-js is why
contributor-scan Req 8.1/8.2 exist.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

tests/test_model_specs.py

@@ -26,7 +26,7 @@ def test_the_guard_classifier_still_recognises_each_kind() -> None:
 
     assert classify_guard_text('cur.execute("SELECT * FROM t WHERE id = %s", (uid,))') == "parameterized_call"
     assert classify_guard_text("if not current_user.is_authenticated: abort(403)") == "auth_check"
-    assert classify_guard_text('if name not in ALLOWED: abort(400)') == "allowlist_test"
+    assert classify_guard_text("if name not in ALLOWED: abort(400)") == "allowlist_test"
     assert classify_guard_text("if len(buf) > 64: return") == "bounds_test"
     assert classify_guard_text("if value is None: return") == "null_test"
     assert classify_guard_text("page = int(raw)") == "type_change"
@@ -50,8 +50,15 @@ def test_the_seeded_families_and_the_named_gaps_are_both_exact() -> None:
         seeded |= {spec.family for spec in dominance_specs(language=language).values()}
     deferred = {"unknown", "memory"}  # the declined bucket and the deferred execution tier
     assert seeded == {
-        "injection", "deserialization", "config_secrets", "access_control",
-        "path", "output_encoding", "untrusted_destination", "prototype", "memory",
+        "injection",
+        "deserialization",
+        "config_secrets",
+        "access_control",
+        "path",
+        "output_encoding",
+        "untrusted_destination",
+        "prototype",
+        "memory",
     }
     gaps = {family.id for family in taxonomy.families} - seeded - deferred
     assert gaps == set(), f"a family lost its seed: {sorted(gaps)}"