fix: replace retired macos-13 runner with macos-15-intel for Intel x64 builds

[Copilot]

• Identify root cause: macos-13 runner was retired on December 4, 2025, causing "The configuration 'macos-13-us-default' is not supported" error
• Update .github/workflows/release.yml: replace macos-13 with macos-15-intel, expand matrix with ARM/Intel separation, fix cz bump --exact-version command
• Update .github/workflows/ci.yml: replace macos-13 with macos-15-intel, add lint job (Ruff), expand build matrix, add permissions: contents: read
• Add ruff>=0.9 to pyproject.toml dev dependencies with [tool.ruff] configuration (matching dev branch) so CI lint job works
• Fix all Ruff lint/format issues across source files (imports, unused vars, formatting)
• Update uv.lock with ruff dependency
• CodeQL scan: 0 alerts

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

Updates GitHub Actions workflows to restore Intel macOS build support after the retirement of macos-13, while also aligning CI/release build matrices across macOS (ARM + Intel) and Windows and improving CI gating.

Changes:

• Replace the retired Intel runner with macos-15-intel and split macOS builds into explicit ARM/Intel entries with distinct artifact names.
• Rework the manual workflow_dispatch release version bump flow to update pyproject.toml, commit (if changed), and tag.
• Expand CI to include a Ruff lint job gating tests and extend the build job to macOS ARM/Intel + Windows with explicit permissions.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/release.yml	Switches to explicit macOS ARM/Intel runners + artifact naming; replaces manual version bump logic with sed/git commit/git tag.
.github/workflows/ci.yml	Adds Ruff lint gating, expands build matrix to macOS ARM/Intel + Windows, and adjusts artifact packaging/upload per OS.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

git tag -a "v${VERSION}" will fail if the tag already exists (e.g., re-running a workflow_dispatch with the same version, or leaving the default input). Consider checking for an existing tag before creating it and either (a) exiting with a clear message / setting bumped=false, or (b) deleting/replacing the tag explicitly if that’s intended.

[MacBuchi]

@copilot Ruf is not available, this is properly configured on dev branch (pyproject.toml)

[Copilot]

Added ruff>=0.9 to the dev dependencies in pyproject.toml along with the full [tool.ruff] configuration (matching the dev branch). Also fixed all lint and format issues in the source files so the CI lint job now passes. Commit: 7e8e98a.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• releases.astral.sh
  • Triggering command: /home/REDACTED/.local/bin/uv uv sync --all-groups (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)