Quality Infrastructure
- Pre-commit hooks (ruff lint + format, trailing whitespace, merge conflicts, private key detection)
- Pinned ruff==0.15.4 in dev dependencies to match CI
- Coverage enforcement at 50% floor (prevents regression)
- Hardened ruff config: 16 rule categories including bandit security checks