Add a code-quality CI job: ruff, mypy, interrogate and pip-audit over scs/py/ #236

Subcategory: linting & style enforcement, type safety, dependency & security hygiene
Current → target: 4 → 8, 3 → 7, 5 → 8

Problem

No code-quality tooling exists anywhere in this repo or its CI.

$ grep -n "ruff\|lint\|black\|flake8\|mypy\|coverage\|--cov\|bandit\|pip-audit\|codeql\|interrogate" .github/workflows/*.yml pyproject.toml
(no matches)

There is no .pre-commit-config.yaml, no ruff.toml, no [tool.ruff], no [tool.mypy],
no mypy.ini, no [tool.interrogate] and no [tool.deptry]. Consequences observed:

• scs/py/__init__.py uses 2-space indentation while test/*.py uses 4-space, and nothing
  enforces either.
• grep -c "def .*->" scs/py/__init__.py returns 0 — no type annotations at all.
• uvx deptry scs reports DEP001 'scs' imported but missing from the dependency definitions
  at scs/py/__init__.py:6; this is the package importing its own compiled submodule and
  only surfaces because there is no [tool.deptry] entry to declare it.
• No dependency or C-source security scan runs at any point.

The build/correctness side of CI is unusually thorough (wheel ELF audit, pristine-container
smoke test, TSan/ASan, free-threading race detection). The code-quality axis is the one that
is entirely missing.

Files / config to change

• add ruff.toml (or [tool.ruff] in pyproject.toml) fixing one indentation style
• add [tool.mypy], [tool.interrogate] and [tool.deptry] to pyproject.toml
  (the deptry entry should declare scs as the package's own module)
• add annotations to the ~10 public signatures in scs/py/__init__.py
• add one job to .github/workflows/ running ruff check, mypy, interrogate and
  pip-audit over scs/py/

Done when

A single CI job runs ruff, mypy, interrogate and pip-audit on every pull request and is
green, with all thresholds coming from committed config rather than command-line flags.