run_reachability_analysis() always receives a manifest tar hash from its
only caller, so drop the Optional default and the conditional that skipped
--run-without-docker/--manifests-tar-hash when it was absent.

Pass tar_hash at the test call sites accordingly.

* Apply ruff autofixes for imports and lint nits

Result of `uv run ruff check --fix --unsafe-fixes`: sort and regroup
imports (isort), drop unused imports, remove f-string prefixes from
strings with no placeholders, drop unused bindings, and simplify
`== True`/`== False` assertions to truthiness checks.

* Add a ruff job to the unit test workflow

Mirrors the checkout and python setup from python-tests. Installs the
dev extra rather than test, since that is where the ruff pin lives.

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>