Adopt ruff 0.16's default rule set and fix the violations

[maxdymond]

Reverts #(commit acec0dee, "Pin ruff lint rule selection explicitly") so ruff.toml uses extend-select again, taking ruff 0.16's expanded defaults rather than freezing the rule set at 0.15's — then fixes the 40 violations that surfaces.

ruff.toml is an exact revert; everything else is the fallout.

Autofixed (29) — typing modernization

Rule	Change
UP006	Dict/List → dict/list
UP045	Optional[X] → X | None
UP035	Deprecated typing imports
UP043	Redundant default type args

By hand (11)

Rule	Change
TRY004 ×2	azcmd: raise TypeError, not ValueError, from the isinstance guards. Checked first — no caller catches ValueError from these methods.
DTZ005	datetime.now().astimezone(), so log filenames keep local time rather than silently switching to UTC.
LOG015	Module logger instead of root logging.info.
PYI034	FuncApp.__enter__ returns Self, so FuncAppZip/FuncAppBundle now type correctly under a context manager.
EXE001	Dropped the vestigial shebang from create_resources.py — it's invoked via the create-resources console script, never directly, so it doesn't need an exec bit.
SIM115 ×2	noqa + comment at the two NamedTemporaryFile sites. The delete=False handle deliberately outlives its scope so the zip can be built into that path; FuncApp.__exit__ unlinks it. A context manager would be wrong here.
RUF100 ×3	Removed stale noqa directives.

Two things worth a look

• A latent bug, unrelated to lint. run_expect_list annotated its local as dict[str, Any] while returning list[str] — a copy-paste error. Corrected to list[str].
• The RUF100 autofix silently ate a rationale. Removing the dead # noqa: BLE001 also took the - pgpy raises a variety of errors note explaining the broad except Exception in signing.load_private_key. Restored as a plain comment.

Verification

Run against the pinned ruff 0.16.2, installed from PyPI — note the ruff on my PATH was 0.15.20, which is why this looked clean locally before:

• ruff check — clean
• ruff format --check — clean
• mypy — clean, 9 source files
• All modules import under 3.13; exercised the new TypeError paths and common_logging at runtime

CI has no test step, so there was no suite to run.

Not included

Setting python_version = "3.13" under [tool.mypy] would pin mypy the same way this PR unpins ruff — without it, mypy infers the version from whichever interpreter it runs under, which makes typing.Self look like an error in an editor using a pre-3.11 Python. Happy to add it here or separately.