Pin ruff to a compatible release (~=0.16.0) (#16694)

The Black -> Ruff migration (AAP-85334) installs a bare, unpinned
`ruff` in four places: requirements_dev.txt, both tox.ini linters
envs, and the devel image Dockerfile. CI's api-lint job resolves the
latest release on every run.

Ruff treats minor releases as breaking by policy: that is where the
yearly formatter style guide lands (0.9.0, 0.15.0) and where rules are
promoted or change behavior. Left unpinned, the next minor turns
unrelated PRs and quiet stable branches red with no code change.

Pin to ~=0.16.0 everywhere, and add `required-version` to
[tool.ruff] so a developer's mismatched local ruff (pre-commit.sh uses
whatever is on PATH) is refused instead of silently reformatting.

Patch releases within 0.16.x still flow, so bug fixes arrive without
a bump; the floor moves through a reviewed PR when 0.17 lands.


Claude-Session: https://claude.ai/code/session_011rb7ruHixj48khUNXxxqPG

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

tox.ini

@@ -3,7 +3,7 @@ isolated_build = True
 
 [testenv:linters]
 deps =
-  ruff
+  ruff~=0.16.0
   yamllint
 allowlist_externals = make
 setenv =