[Wid-L-Hacker]

Phase-2 modernization, rebuilt on top of merged #28 so the content diff against current main is phase-2-only.

• Portable-build SQLite pin 3.41.2 -> 3.54.1 (Dockerfile ARG SQLITE_VERSION=3540100, amalgamation /2026/ URL), per the project version policy of advancing the bundled pin to the newest upstream release at each maintenance touch. The named BuildKit stages and the git safe.directory line from Resurrect CI: modernize workflows and fix bit-rot (no dependency changes) #28 are retained.
• Ruff migration: ruff replaces black/flake8/pylint for formatting and linting. Root ruff.toml ports the former tools' settings and the pylint disable list (with rationale); pre-commit switches to ruff-pre-commit v0.17.1; the CI lint venv installs ruff (unpinned, per the standing canary policy). I001 import sorting adopted. Formatting was applied over the post-Resurrect CI: modernize workflows and fix bit-rot (no dependency changes) #28 tree, so the fd-based CLI init and plain load_extension() from Resurrect CI: modernize workflows and fix bit-rot (no dependency changes) #28 are semantically unchanged (verified: identical ASTs apart from import order).
• JDBC hygiene: junit 4.13.1 -> 4.13.2 and nine Maven plugin pins to current 3.x in the JDBC pom; test/MavenSmokeTest/pom.xml aligned the same way (incl. its Java floor 1.7 -> 1.8, matching the JDBC pom). Spotless stays 3.10.4; the sqlite-jdbc version range stays open.
• Docs dev-package list updated (black/pylint/flake8 -> ruff).

Supersedes #27: same phase-2 content, rebuilt on the merged main instead of the pre-#28 base.