ci: the backend gate now checks exactly what it promises (#399)

Three claims a green backend used to make, each slightly wider than the
truth — and #392 happened in exactly that gap.

The frontend pin said 20260826.1 next to homeassistant==2026.8.3, whose
package_constraints.txt requires 20260729.7: a combination that exists
in no HA release. It was never derived from anything — someone once
picked it. It is now taken from the constraints, the source is named in
the file, and a test holds both numbers together so raising HA cannot
quietly desync them.

ruff's include declared three trees while CI linted one. Narrowed the
declaration rather than widening CI: the debt in scripts/ and
tests_backend/ (56 findings, mostly E402/I001, plus 7 B023 and 5 B017)
has its own cost and its own decisions, and belongs in its own task, not
in a visibility fix. test/lint-scope.test.mjs now compares the two, so
they can only move together.

The pin check skipped a workflow when it found neither the package name
nor the requirements path — and both vanish together the moment someone
returns to Defaulting to user installation because normal site-packages is not writeable, i.e. the gate switched itself off
under precisely the change it exists to catch. It now walks the whole
.github/workflows directory and decides per file by a positive sign: if
a file installs python packages, it must install them from the pins
file. Verified by dropping a rogue workflow into the directory — it
reddens without touching any list.

Three mutants registered and each run by hand.

User-Visible: no
Issue: #399

scripts/mutation-gate.mjs

@@ -746,6 +746,39 @@ const MUTANT_DEFINITIONS = [
       replace: "      this._persistDecorStyle();\n    }, 0);",
     }],
   },
+  {
+    id: 'workflow-scan-hardcodes-the-list',
+    guard: 'node --test test/validate-workflow.test.mjs',
+    because: 'scanning a fixed pair of names is how a third workflow installs '
+      + 'unpinned dependencies unnoticed — the shape #399 removed',
+    patches: [{
+      file: 'test/validate-workflow.test.mjs',
+      find: "  const workflows = readdirSync(WORKFLOWS).filter((name) => name.endsWith('.yml'));",
+      replace: "  const workflows = ['validate.yml'];",
+    }],
+  },
+  {
+    id: 'lint-scope-drifts',
+    guard: 'node --test test/lint-scope.test.mjs',
+    because: 'a declared lint scope wider than the checked one is what let '
+      + 'F401/F811 into tests_backend unnoticed (#399)',
+    patches: [{
+      file: 'pyproject.toml',
+      find: 'include = ["custom_components/houseplan/**/*.py"]',
+      replace: 'include = ["custom_components/houseplan/**/*.py", "tests_backend/**/*.py"]',
+    }],
+  },
+  {
+    id: 'frontend-pin-drifts-from-ha',
+    guard: 'node --test test/backend-pins.test.mjs',
+    because: 'a frontend pin nobody derives from the pinned HA is how the '
+      + 'harness ends up testing a combination that does not exist (#399)',
+    patches: [{
+      file: 'tests_backend/requirements.txt',
+      find: 'home-assistant-frontend==20260729.7',
+      replace: 'home-assistant-frontend==20260826.1',
+    }],
+  },
   {
     id: 'sysmodules-guard-blind-to-variable',
     guard: 'node --test test/backend-test-hygiene.test.mjs',