chore: migrate CI workflows to uv and update dev tooling (#3426)

chore(dev): update tooling & CI workflows

- Upgrade ruff, mypy (strict), pre-commit; add hooks, stubs, config consolidation
- Add bandit to dev deps and update uv.lock
- Enhance ruff rules (modern Python style, B006 for mutable defaults)
- Update workflows to use uv, matrix strategy, and changed-file type checking
- Include tests in type checking; fix job names and add summary job for branch protection

.pre-commit-config.yaml

@@ -1,7 +1,14 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.2
+    rev: v0.12.11
     hooks:
       - id: ruff
-        args: ["--fix"]
+        args: ["--config", "pyproject.toml"]
       - id: ruff-format
+        args: ["--config", "pyproject.toml"]
+  
+  - repo: https://github.com/pre-commit/mirrors-mypy
+    rev: v1.17.1
+    hooks:
+      - id: mypy
+        args: ["--config-file", "pyproject.toml"]