fix(cli): single import style for importlib in the operator CLI

[oabolade]

Clears the remaining code-quality finding on main.

The finding

github-code-quality flagged importlib imported both ways in rootsign/cli.py:

line
21	from importlib import resources — pre-existing
53	import importlib — came in with #28's _require()

Accurate, and mine.

The fix

Rather than renaming the local import, hoisted import_module into the existing module-level from importlib import ... and dropped the function-local import entirely:

from importlib import import_module, resources
...
def _require(module: str) -> Any:
    try:
        return import_module(module)

importlib is stdlib, so there was never anything to defer — _require is now three lines shorter and the file has one import style.

This does not undo #28. What had to be lazy there was psycopg2 / alembic (the optional postgres extra), never importlib itself.

Verification

Re-ran against a real bare install to confirm #28's behaviour is intact:

rootsign-admin --help  -> exit 0
rootsign-admin status  -> install hint, exit 1  (missing module: psycopg2)
rootsign-admin init    -> install hint, exit 1  (missing module: alembic)

• Full suite: 500 passed, 6 skipped
• ruff check clean apart from the 2 pre-existing E402s

The other open finding

except BaseException at rootsign/sdk/decorator.py:344 — dismissed, not fixed. It's the ADR-002 failure-isolation pattern: the handler stores error = exc, runs _try_ingest, then re-raises unconditionally (raise error), so KeyboardInterrupt / SystemExit still propagate — just after the ACTION_RECORD is emitted, which is the whole point.

Worth noting why it reappeared: it was dismissed earlier in this audit at decorator.py:299. Dismissals are pinned to a location, so when _log_safe and the postgres_extra_required import shifted the line to 344, CodeQL opened it as a new finding. Same mechanism that reopened log-injection alerts #8/#9 as #10/#11. Expect this one to resurface on any future edit above it in that file.

🤖 Generated with Claude Code