chore(python): audit plugins shared modules

_managed_files owns the file snapshot reader and public metadata helpers used by pinned directories, durable copies, and opaque snapshots; transaction staging owns read_target and same_identity_and_contents; dead helpers removed; hook_template no longer re-exports the guard generator; mypy targets win32 so _windows_security type-checks.

Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq

elydora/plugins/_durable_file.py

@@ -6,6 +6,7 @@ import os
 import stat
 from typing import Any, Optional, Tuple
 
+from ._managed_files import same_file_metadata
 from ._pinned_directory import PinnedDirectory
 
 
@@ -27,16 +28,6 @@ def _regular_identity(
         raise OSError(f"{label} changed while copying: {path}")
 
 
-def _stable_metadata(metadata: os.stat_result) -> tuple[int, int, int]:
-    # Timestamps are excluded: Windows exposes file times with delayed
-    # cross-handle visibility, so they are unsound identity evidence.
-    return (
-        metadata.st_dev,
-        metadata.st_ino,
-        metadata.st_size,
-    )
-
-
 def copy_into_reserved(
     directory: PinnedDirectory,
     source_path: str,
@@ -88,7 +79,7 @@ def copy_into_reserved(
         directory.chmod_descriptor(destination_descriptor, mode)
         os.fsync(destination_descriptor)
         after = os.fstat(source_descriptor)
-        if _stable_metadata(after) != _stable_metadata(before):
+        if not same_file_metadata(after, before):
             raise OSError(f"{label} changed while copying: {source_path}")
     finally:
         for descriptor in (destination_descriptor, source_descriptor):