chore(ci): Pin Ruff 0.15.2 and run via ruff-action

Pin Ruff to v0.15.2 in CI and pre-commit to avoid breakages from
upstream releases. Run Ruff via astral-sh/ruff-action (pinned by SHA)
instead of installing Ruff via pip.
Document where Ruff is pinned and keep the release checklist/style guide
in sync.

Fixes #21472
Fixes #21497

ruff.toml

@@ -45,6 +45,8 @@ extend-select = [
     "UP",        # pyupgrade: modernize syntax for your target Python (e.g., f-strings, built-in generics, newer stdlib idioms)
     "RUF022",    # ruff: enforce sorted `__all__` lists
 ]
+# If you add a rule to `ignore`, please also update the "Linter Exceptions" section in
+# docs/development/style-guide.md.
 ignore = [
     "F403",      # pyflakes: `from ... import *` used; unable to detect undefined names
     "F405",      # pyflakes: name may be undefined or defined from star imports