ci: run ruff once outside syntax matrix

[nightcityblade]

Description

Fixes #81

Move the pinned Ruff install and lint steps into a standalone Python 3.10 job. Ruff now runs once per workflow while syntax-check continues to byte-compile every tracked Python module on Python 3.10 through 3.14.

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would change existing behavior)
• Documentation update
• Refactor / code cleanup
• Other: CI workflow maintenance

Checklist

• I have tested my changes locally
• If this affects shared logic (extraction, download engine), I also
  applied the equivalent change to moon_cli.py
• I have kept the single-file architecture (no package split)
• I have not added new dependencies without justification in the PR
  description

Shared extraction and download logic is unaffected; this change only adjusts the lint workflow.

Testing

• .venv/bin/ruff check .
• python3.10 -m compileall -q, through python3.14 -m compileall -q, on every tracked Python file
• actionlint .github/workflows/lint.yml

Screenshots / logs (if applicable)

N/A — CI-only change.

[LeyckerS]

Clean, and the diff is smarter than its size suggests: +11 -0 because you inserted the new job header above the existing steps and re-parented them, rather than deleting and retyping. Reads perfectly in the resulting file.

Checked the outcome rather than the diff:

• syntax-check keeps the 3.10–3.14 matrix and now byte-compiles only.
• ruff is a standalone job on a single interpreter.
• CI reports one ruff check against five syntax-check entries — previously it was five ruff runs of identical work.

You kept the pin. ruff==0.16.1 is the detail I flagged when you claimed this, and it is the one that matters: an unpinned linter turns someone else's unrelated pull request red on the day upstream adds a rule. Thank you for holding it.

Also correct that ruff runs on 3.10 rather than the newest — the linter's own behaviour should not vary with the interpreter it happens to be installed under, and target-version = "py310" in ruff.toml is what actually decides what it checks.

actionlint in your testing notes is a nice touch; nothing in this repository asks for it.

Merging.