Widen the ruff ruleset — `B` and `S` are off and surface 350+ real hits

[christian-byrne]

What — [tool.ruff] selects only E, F, I, Q, RET504, UP, W. Bugbear (B), bandit (S), complexity (C901), unused-arguments (ARG), and commented-out-code (ERA) are all off.

Why it matters here — Ruff is already installed, already runs in CI on every PR, and already gates formatting — so the marginal cost of more rules is close to zero, and the marginal value is 350+ findings that nothing currently reports. The notable ones: 59 B904 (raising inside except without from, which destroys the original traceback in a CLI where the traceback is the bug report), 39 S110 (silent try/except/pass), and 12 B008 (mutable default arguments).

Evidence

$ python3 -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['tool']['ruff']['lint']['select'])"
['E', 'F', 'I', 'Q', 'RET504', 'UP', 'W']

$ ruff check --select F401,F841,ARG,ERA,B,S,C901 --statistics comfy_cli | head -8
90	C901  	complex-structure
59	B904  	raise-without-from-inside-except
57	S603  	subprocess-without-shell-equals-true
39	S110  	try-except-pass
23	ERA001	commented-out-code
21	ARG001	unused-function-argument
14	S310  	suspicious-url-open-usage
12	B008  	function-call-in-default-argument

Fix

Add rules in waves rather than all at once. Start with B904 and S110 (both point at real error-handling bugs), fix or # noqa the existing hits, then add ERA and ARG. S603/S607 will be mostly noise in a CLI that shells out by design — expect to ignore those two.

---

Found by repo-audit during repo improvement sweep 2026-08-17. Parent: #723