build(lint): gate make test on a clean ruff run

ruff was never wired into this repository: no target, no CI step, no pin.
It reported 45 findings across sources and tests, so nothing enforced
what the codebase already mostly followed.

Adds `make ruff` (check + format --check), `make ruff-fix`, and `make
lint` as its alias, and makes `make test` run lint as a fourth parallel
spur. The CI workflow calls `make test`, so it is covered there too. The
linter is pinned in a `lint` extra: a ruff minor bump changes which rules
fire, and with the suite gating on a clean run an unpinned linter would
fail it on an unrelated day.

The 45 findings are fixed rather than configured away. Three needed a
decision instead of the mechanical fix:

- The generation timestamp keeps its local wall clock (DTZ005 waived).
  Generations sort by that name, and UTC would order new ones before the
  existing ones wherever the offset is positive - "newest generation" is
  what every restore path selects on.
- The per-volume `copy` closure now binds volume_name and vol_dir as
  default arguments (B023). It only worked because it is called inside
  the same iteration.
- The two CLI top-level handlers keep their blind except (BLE001
  waived): turning any failure into exit 1 is what a CLI boundary is
  for. The two in run.py did not need it and were narrowed to what they
  actually catch.

Also drops the comments that restate the code: the section banners in
restore/__main__.py, the filename repeated as line 1 of nine test files,
step narration above the statement it narrates, and a block in app.py
documenting parameters that had moved to another module. What names a
trip-wire stays - the snapshot destination rule, the mysql-binary
absence in MariaDB 11 images, the session-scoped FOREIGN_KEY_CHECKS, the
spooled temp file for multi-GB dumps, and the negative control that
loses its discriminating power if it ever passes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/e2e/test_e2e_postgres_cluster_restore.py

@@ -16,15 +16,8 @@ from .helpers import (
     write_databases_csv,
 )
 
-# A `database = '*'` row makes the backup side write one pg_dumpall stream for
-# the whole instance instead of a dump per database - the shape an application
-# with several databases in one engine produces. This proves the stream is
-# replayable: two databases and their owning role are dropped outright, and the
-# cluster restore has to bring all three back. Before the cluster subcommand
-# existed the dump was stored and unreadable.
-# Each statement runs on its own: psql wraps a multi-statement -c in one
-# transaction, and CREATE DATABASE is forbidden inside one - the same rule that
-# keeps the cluster replay out of --single-transaction.
+# One statement per entry: psql wraps a multi-statement -c in a transaction,
+# and CREATE DATABASE is forbidden inside one.
 SEED_SQL = (
     "CREATE ROLE app LOGIN PASSWORD 'apppw'",
     "CREATE DATABASE first OWNER app",
@@ -96,7 +89,6 @@ class TestE2EPostgresClusterRestore(unittest.TestCase):
             / f"{cls.pg_container}.cluster.backup.sql"
         )
 
-        # The disaster: both databases and the role that owns them are gone.
         for statement in DROP_SQL:
             cls._psql("postgres", statement)
 
@@ -156,9 +148,6 @@ class TestE2EPostgresClusterRestore(unittest.TestCase):
         self.assertEqual(self._psql("second", "SELECT v FROM t"), "second-payload")
 
     def test_the_superusers_own_create_was_filtered(self) -> None:
-        # The dump recreates every role including the one the replay connects
-        # as; only its ALTER may survive, or the stream dies on the first
-        # statement with ON_ERROR_STOP.
         self.assertEqual(
             self._psql(
                 "postgres", "SELECT rolsuper FROM pg_roles WHERE rolname = 'postgres'"