v1.108.76 - Quality gates: CI lint (ruff) + coverage floor

Phase 3 WI-3.1 — the CI gates that stop debt from landing. New lint job runs ruff check src/ once (platform-independent); [tool.ruff.lint] keeps high-signal pyflakes + pycodestyle-error rules and grandfathers the codebase's deliberate patterns (E402 lazy imports; a few style codes), with init.py re-exports exempt from F401. The test job now runs --cov-fail-under=74 (current ~76%) so coverage cannot erode silently. Applied ruff's safe autofixes across 49 modules (83 findings: unused imports, empty f-strings, redefinitions, safe dead-code) with no behavior change. Fixed two real findings: an undefined IO annotation in server.py and a duplicate .sh dict key in storage/sqlite_store.py. Deferred ratchets: F841 (~31 pre-existing dead locals) and a mypy/pyright report-mode step. Full suite 4717 passed / 10 skipped.