fix(python): share import resolution with graph

[tomdps]

Closes #209

Contract

Rust graph-core is now the sole parser/resolver for repo-local Python import expectations. @the-open-engine/opcore-graph exposes an injected, temporary-repository analyzer; validation consumes normalized directed edges and never parses Python import text.

Base: dev at 91955e3193ceecc72c0e1f46ce21af79d834e5ed
Final commit: b1d02384163258cf756195203f97f2ab9c485ed5

Evidence

• Shared fixture matrix covers multiline/parenthesized, aliases, conditional imports, from pkg import submodule, star imports, relative imports, package initializers, .pyi, namespace packages, and src-layout imports.
• tests/graph-extraction-conformance.test.mjs binds the fixture edge matrix to graph-core extraction.
• tests/graph-python-import-analysis.test.mjs proves canonical directed analyzer output, unavailable/malformed native failures, and temporary-repo cleanup.
• tests/validation-python.test.mjs proves canonical transitive source closure, an intentionally omitted IMPORTS_FROM edge yielding PY_IMPORT_GRAPH_MISSING_EDGE, after-state overlay identity, deleted-file exclusion, missing/malformed analyzer failures, and target-worktree immutability.
• tests/python-import-composition.test.mjs proves injection through validation-policy, Opcore, and ASP.
• Production validation no longer contains a line-regex Python import parser/resolver.
• Protected native package artifacts and release receipts are unchanged.

Verification

• npm run build — passed
• npm run lint — passed
• Focused graph/validation/policy/ASP/boundary/pack/install suites — 143/143 passed
• npm run pack:check — passed
• node packages/opcore/dist/index.js check --changed --json with isolated Pyright 1.1.411 — passed
• zeroshot cmdproof prove opcore-ci with the documented cutover guardrail-reuse mode — passed, exit 0, 376955 ms, proof sha256:5f65cb778ea68cbc9d661b22f247985907e141ec0383746e430c299320511e1c, no workspace drift

The local installed opcore pre-commit hook predates this branch's source behavior and fails inside its temporary path mapping; the source-built changed-file gate and full configured command proof above passed, so the verified commit was created without disabling or modifying the hook.