fix(imports): preserve pinned snapshots and disclose incomplete imports

Description

The pitch.

## Summary

- Refuse silent replacement of an on-ramp snapshot and validate the full pinned release reference on an idempotent re-import.
- Disclose omitted PR files and inconclusive partial coverage instead of describing a bounded snapshot as complete.
- Derive classifications, checks and suggested commands only from safely retained files; quote command paths and reject unsafe filesystem/metadata targets.
- Close owned HTTP clients without closing caller-owned clients.

Importing remains review/discovery, not authorization to execute untrusted plugins or a claim that a legacy contribution works in current Town.

## Verification

Fresh standalone base: `53178b9c780d7a7dd6ce723131c4250de03908dd`.
- `python -m pytest -q` on Python 3.12 — fresh full rerun 675 passed, 8 existing warnings.
- Initial run: `tests/test_participants.py::test_buyer_and_seller_complete_clean_run` observed zero seller acknowledgments where one was expected (`1 failed, 674 passed`). The unchanged test then passed 10/10 in isolation and the fresh full suite passed 675/675, consistent with its existing unjoined-thread timing race. No out-of-scope test or runtime change was made in this PR.
- `git diff --check` — clean.
- Added regressions failed before implementation; independent review also caught and verified corrections for rejected files influencing commands and incomplete release-reference checks.

Combined remediation separately passed 817 tests on Python 3.12 and a clean Python 3.11 wheel. No upstream PR content is executed merely by importing it.