chore(python): audit plugins shared modules

_managed_files owns the file snapshot reader and public metadata helpers used by pinned directories, durable copies, and opaque snapshots; transaction staging owns read_target and same_identity_and_contents; dead helpers removed; hook_template no longer re-exports the guard generator; mypy targets win32 so _windows_security type-checks.

Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq

elydora/plugins/_transaction.py

@@ -6,12 +6,7 @@ import os
 from typing import List, Optional, Sequence, cast
 from uuid import uuid4
 
-from ._managed_files import (
-    FileSnapshot,
-    MAX_SOURCE_BYTES,
-    physical_file_exists,
-    read_physical_file,
-)
+from ._managed_files import FileSnapshot, MAX_SOURCE_BYTES, read_physical_file
 from ._opaque_cleanup import cleanup_opaque_removal
 from ._opaque_removal import (
     OpaqueRemovalChange,
@@ -65,15 +60,6 @@ def recover_pending_transactions() -> None:
     _recover_pending_transactions()
 
 
-def read_optional(
-    file_path: str,
-    label: str,
-    maximum_bytes: int = MAX_SOURCE_BYTES,
-) -> Optional[str]:
-    snapshot = read_physical_file(file_path, label, maximum_bytes)
-    return None if snapshot is None else snapshot.contents
-
-
 def source_change(
     file_path: str,
     label: str,
@@ -479,14 +465,3 @@ def write_changes(
             directory_preconditions,
             opaque_removals,
         )
-
-
-def regular_file_exists(file_path: str, label: str) -> bool:
-    return physical_file_exists(file_path, label)
-
-
-def require_runtime(file_path: str, label: str) -> None:
-    if not file_path:
-        raise ValueError(f"{label} path is required")
-    if not regular_file_exists(file_path, label):
-        raise FileNotFoundError(f"{label} is missing: {file_path}")