fix: runtime Python import blocking via __import__ hook

[b-macker]

Summary

• Override builtins.__import__ in PythonCExecutor to enforce govern.json blocked imports at runtime
• Catches dynamic imports (__import__("o"+"s"), importlib.import_module()) that bypass static source scanning
• Closes F-3 from Round 6 slop audit (the last remaining finding)
• Removed stale TODO comment in main.cpp

Changes

• src/runtime/python_c_executor.cpp — inject __import__ hook before user code execution, reading blocked list from GovernanceEngine::getCurrent()->getLanguageConfig("python")->imports.blocked
• src/cli/main.cpp — replaced TODO with documentation comment pointing to new implementation

Test plan

• cd build && cmake .. && make naab-lang -j4 — compiles clean
• bash run-all-tests.sh — 396/396, 0 unexpected failures
• Manual test: dynamic __import__("sub"+"process") blocked when subprocess in blocked list
• CI passes

🤖 Generated with Claude Code

[github-actions]

NAAb Governance Report

Metric	Count
Files checked	16
Passed	16
Failed	0

All governance checks passed!

_{Generated by NAAb Governance Engine v4.0}