fix(ci): exclude canary corpus from ruff, add import smoke test

CI has been red repo-wide: the latest ruff wants to reformat the
intentionally-vulnerable canary fixtures (whose line numbers are keyed
in canary-meta/KEY.md), and pytest --collect-only exits 5 with zero
tests. Exclude canary/ via ruff.toml and add a root-level import smoke
test so collection is non-empty and imports cross_review.py.

ruff.toml

@@ -0,0 +1,4 @@
+# canary/ is the intentionally-vulnerable scanner-recall corpus: it must stay
+# byte-stable (canary-meta/KEY.md keys findings to its line numbers) and linting
+# deliberately-bad code is meaningless, so ruff skips it entirely.
+extend-exclude = ["canary"]

test_imports.py

@@ -0,0 +1,13 @@
+"""Import smoke test.
+
+CI runs `pytest --collect-only` as an import check; collection imports this
+module, which imports the repo's Python entry points. No API calls are made
+(cross_review imports the openai SDK lazily, inside the call path).
+"""
+
+import cross_review
+
+
+def test_cross_review_importable():
+    assert cross_review.DEFAULT_MODEL == "gpt-4.1"
+    assert "BLOCK" in cross_review.CROSS_REVIEWER_PROMPT