chore(python): audit plugins shared modules

_managed_files owns the file snapshot reader and public metadata helpers used by pinned directories, durable copies, and opaque snapshots; transaction staging owns read_target and same_identity_and_contents; dead helpers removed; hook_template no longer re-exports the guard generator; mypy targets win32 so _windows_security type-checks.

Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq

elydora/plugins/kimi_installation.py

@@ -12,7 +12,8 @@ from elydora._runtime_paths import resolve_agent_directory
 from ._managed_files import MAX_CONFIG_BYTES, MAX_SECRET_BYTES, MAX_SOURCE_BYTES
 from ._transaction import FileChange, file_change, source_change, write_changes
 from .base import InstallConfig
-from .hook_template import generate_guard_script, generate_hook_script
+from .guard_template import generate_guard_script
+from .hook_template import generate_hook_script
 from .kimi_command import runtime_root, same_kimi_path
 from .kimi_contract import (
     AGENT_KEY,