fix: don't emit unused stdlib imports into vendored runtime bundles

[open-coder-ai]

What

chock.gate.runtime_bundle.render() spliced one fixed _chock_-renamed stdlib import block (os, shlex, shutil, subprocess, datetime, timezone, Path) into every agent's vendored runtime bundle, regardless of which of those names the assembled handler source (guard_runner + optionally sessionstart) actually referenced. shutil is used only by sessionstart, which is extracted for claude_code alone — so every other vendor's .chock/bin/<agent>.py carried a dead import shutil as _chock_shutil.

Surfaced by CodeQL in chock-catalog#56 — the first time that repo's adoption pipeline compiled the full nine-vendor set introduced by agentseam 0.2.1/chock 0.8.0 (previously only claude_code, cursor, vscode_copilot, and gate existed there).

render() now filters _IMPORTS per agent against what _handler_source(agent) actually references, instead of splicing it unconditionally.

Definition of done

• chock check → 0 errors, 0 warnings, 0 infos
• chock check --only matrix passes (no behavior change, matrix unchanged)
• chock sync --repo . --check clean
• chock check --only verify clean
• Registry rescanned; no stale entries (no manifest changes in this PR)
• pytest -q green (1058 passed, 3 skipped)
• pytest acceptance/ -c acceptance/pytest.ini --rootdir=acceptance green
• No existing artifacts need migration (no check added/extended, no manifest touched)
• Changelog entry added (Unreleased). No version bump — a code-generation bugfix with no behavior/enforcement change, not a release itself.
• ruff check . and ruff format --check . clean (on the touched file)

Claims

• No surface is described as enforcing more than it installs — this only removes a dead import from generated output; the handler logic and every enforcement surface are byte-identical except for that one line, confirmed by diffing all 11 regenerated runtime goldens (9 changed, each losing exactly the import shutil as _chock_shutil line; claude_code and gate unchanged).

🤖 Generated with Claude Code

https://claude.ai/code/session_01RcphZmVVXoy8Jf2tUtcsC3

---

Generated by Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 9e74bbb5-7e45-45c0-aa65-7faeec2690c3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}