Run Ruff without fixes around hashed evidence artifacts

When running Ruff over source directories containing immutable diagnostic snapshots, explicitly disable fixes and preferably use a source-file allowlist. Repository configuration can enable auto-fix even when the command omits a fix flag, and a relative exclusion pattern may not match the full nested path. A nonzero lint exit can still follow partial file rewrites. Treat that exit as neither read-only nor transactional. If an artifact changes, restore it only from bytes matching its previously recorded digest; then verify the restored digest before relying on its provenance. This protects artifact integrity, not correctness of the original evidence.

Applies when: Ruff checks code beside content-addressed snapshots or evaluation evidence. Keywords: Ruff lint autofix configuration immutable artifacts snapshots hash exclusion