CI has no nix shell, and ruff was only ever a nix package, so both lint steps died with "Failed to spawn: ruff". Pinned exactly: the formatter deciding what is correct must be one version, or CI rejects what the dev shell produced.
ignore JWT related warning that was introduced when updating dependencies related to JWT secret size (test value of "secret" is too short).