chore(python): audit plugins shared modules

_managed_files owns the file snapshot reader and public metadata helpers used by pinned directories, durable copies, and opaque snapshots; transaction staging owns read_target and same_identity_and_contents; dead helpers removed; hook_template no longer re-exports the guard generator; mypy targets win32 so _windows_security type-checks.

Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq

elydora/plugins/hook_template.py

@@ -5,11 +5,8 @@ from __future__ import annotations
 import sys
 
 from .error_log_template import ERROR_LOG_RUNTIME
-from .guard_template import generate_guard_script
 from .runtime_reader_template import PROTECTED_RUNTIME_READER
 
-__all__ = ["generate_guard_script", "generate_hook_script"]
-
 
 def generate_hook_script(
     *,