Enable ruff exception rules (TRY, EM, BLE)

[anth-volk]

Fixes #3912

Summary

Phase 1 step 1.8, group 5: exceptions and messages. Stacked on #3907.

• Rules: select gains TRY, EM and BLE. All 1,337 findings at the base are fixed.
• Messages (EM101 407, EM102 226, TRY003 605): ruff's fix builds each message in a variable before the raise (633 places). A script put every message back inline in both trees: all 122 files came out identical, so the message text is unchanged. It also found no clash with an existing msg in any scope.
  • Error codes renamed: where the first argument of SPMValidationError is an error code, the hoisted variable is named error_code, not msg (18 places).
• Raises inside try blocks (TRY301 32, TRY300 1): each raise moves into a small helper, so a handler can't catch its own raise. Each handler still receives the same exceptions. The helpers live in the simulation entrypoint, the worker SPM client, spm, the economy service, the routes and one test.
• Exception types:
  • TRY002 (5): the v1 services raise named exceptions, such as InvalidPolicyIdError, instead of bare Exception. Each subclasses Exception directly, and Flask's generic handler still renders str(error), so responses are unchanged.
  • TRY004 (17): 10 type checks now raise TypeError, where nothing catches the old type specifically or the only handler treats both alike. 7 keep their type with a reason:
    • Two Pydantic validators keep ValueError. TypeError would turn a validation error into a 500.
    • Four spm checks keep ValueError, because calculation_spm_receipt catches only ValidationError and ValueError.
    • constants.py keeps RuntimeError, which a test asserts.
  • TRY201 (3): raise e becomes a bare raise in the reform-impact persistence handlers.
• Broad except Exception catches (BLE001 38):
  • Narrowed (1): country.py now catches only the three errors float() can raise.
  • Kept (37), each with an inline reason: most are telemetry, cache and logging code that must never fail a request. The rest are a health probe, route-level catch-alls and a mirror safety net after a committed write. None of them already logged in a form ruff accepts, and adding logging would change log output.
  • Older suppressions: ten noqa: BLE001 comments, inert until now, used the - reason style. They now use the standard # reason form.
• Log output: the three household calculation error logs (TRY401) use a fixed message instead of repeating str(error); the traceback still ends with the exception and its message. Elsewhere, tracebacks gain a frame for each new helper and lose the extra raise e line.
• Published schemas: byte-identical to the base. That covers 234 Pydantic models, 104 TypeAdapters, the FastAPI OpenAPI with every native router enabled, the /v2/openapi.json preview and the legacy spec.
• Registry: api.quality.ruff-lint now lists BLE, EM and TRY. The shared rules tool needed no changes and is still byte-identical with sim (tool sha256 db83d5ad2aa4). Sim's group 5 is Enable ruff exception rules (TRY, EM, BLE) policyengine-sim-api#783.

Testing

• pytest tests/unit tests/contract, to_refactor and the dedupe integration test (the make test set) at this branch's tip: 2,420 passed.
• make typecheck-v2 is clean. mypy on the 15 changed files outside that gate gives the same output as the base.
• ruff check and ruff format --check (0.15.12) are clean repo-wide.
• The quality guards, the rules guard and the rules tool unittest pass.
• CI: this PR is above the bottom of its stack, so it runs only CI complete, which fails and says why (step 0.7, Make CI enforcement trustworthy before the rules registry #3887). Its full run starts once the PRs below it merge.

🤖 Generated with Claude Code