[Hermes] Add ruff lint CI step and update actions to v6

[Coding-Dev-Tools]

Summary

Add a dedicated lint job to CI that runs ruff check, and update outdated GitHub Actions.

Why this change

• ruff is configured in pyproject.toml but not gated in CI — lint errors can silently merge without this check
• actions/checkout@v4 and actions/setup-python@v5 are outdated — v6 is the latest
• Supersedes dependabot PRs chore(deps): bump actions/setup-python from 5 to 6 #1 and chore(deps): bump actions/checkout from 4 to 6 #2 which only bump the action versions

What changed

• Added a separate lint job that runs ruff check src/ tests/ before tests
• Updated actions/checkout from v4 → v6
• Updated actions/setup-python from v5 → v6
• Minor YAML formatting normalization (consistent quoting)

Validation performed

• ruff check src/ tests/ — All checks passed locally
• pytest tests/ -v — 6 passed
• Lint job is separate from test job for fast fail on style issues

Risks / rollback

• Low risk: ruff check already passes on the codebase
• If lint job fails in CI due to environment differences, it can be reverted to a single-job approach
• Dependabot PRs chore(deps): bump actions/setup-python from 5 to 6 #1 and chore(deps): bump actions/checkout from 4 to 6 #2 should be closed after this merges

Follow-ups

• Close dependabot PRs chore(deps): bump actions/setup-python from 5 to 6 #1 and chore(deps): bump actions/checkout from 4 to 6 #2 as redundant
• Consider adding ruff format --check step in a future PR