Completes the repo-wide safeguard rollout (see screen-locker). Adapted for
the python_pkg monorepo:
- meta/scripts/check_requirements_sync.py: fails if a python_pkg import
isn't declared in requirements.txt. Treats python_pkg subpackages
(imported bare) as first-party and maps PIL->pillow (both were false
positives here — pillow is already declared).
- meta/scripts/ci_mirror.sh: pre-push gate = requirements.txt-only clean
venv (hash-gated), `SKIP=pytest-coverage pre-commit run --all-files`,
then the OOM-safe changed-packages runner inside that venv (user chose
changed-packages over the full raw suite to stay within memory).
- Existing pre-commit-stage pytest-coverage hook left untouched.
Verified: mirror green end-to-end (clean venv + all-files + pytest).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018PMRRVVkeRyrSaaqueMZKG
