Run Ruff without fixes around hashed evidence artifacts
When running Ruff over source directories containing immutable diagnostic snapshots, explicitly disable fixes and preferably use a source-file allowlist. Repository configuration can enable auto-fix even when the command omits a fix flag, and a relative exclusion pattern may not …