Turns on ruff's S rules, which matter for code that shells out to ffmpeg, aria2c and yt-dlp. S607 is ignored project-wide: binaries are looked up on PATH deliberately and preflight-checked with shutil.which, so hardcoding absolute paths would be less portable rather than safer. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>