harden import path resolution: full importlib isolation (Approach B)

Replace all bare ComfyUI internal imports with centralized _load_module()
using importlib.util.spec_from_file_location(). This eliminates sys.path
shadowing attacks, removes the remove/re-insert gap window, and makes
import resolution deterministic regardless of working directory, install
layout, or prior sys.path state.

node_runtime.py — core rewrite:
- Add _load_module(): centralized importlib isolation layer that loads
  modules from explicit file paths verified against a ComfyUI root
  confirmed by _is_comfyui_directory() (checks for nodes.py marker)
- Add _is_comfyui_directory(): structural verification of candidate paths
- Add _find_from_extension_location(): walk up from __file__ via realpath
  to find ComfyUI root (handles symlinked installs)
- Rewrite get_comfyui_path(): multi-strategy fallback chain:
  (1) COMFYUI_PATH env var with verification, (2) relative extension walk,
  (3) CWD walk as depth-limited last resort (max 20 levels)
- Replace bare 'from nodes import NODE_CLASS_MAPPINGS' with _load_module()
- Replace bare 'import execution/server' with _load_module()
- Replace bare 'from main import load_extra_path_config' with _load_module()
  (alias "comfy_main" to prevent sys.modules cache collision)
- Replace bare 'from utils.extra_config import ...' with _load_module()
- Replace bare 'import comfy.options/cli_args' with _load_module()
- Replace bare 'import cuda_malloc' with _load_module()
- Rewrite add_comfyui_directory_to_sys_path(): idempotent insert-once,
  no remove/re-insert gap window
- Rewrite import_custom_nodes(): _load_module() for execution/nodes/server,
  eliminated sys.path.remove() that created a gap window for lazy imports
- Rewrite get_node_class_mappings(): _load_module() for nodes.py
- Replace all print() statements with logging.DEBUG (no path leaks to stdout)
- Add None guards on args attributes after cli_args module load

generator/render.py — generated script isolation:
- Embed _load_module(), _is_comfyui_directory(), _find_from_extension_location()
  in generated scripts via inspect.getsource()
- Add importlib.util and logging imports to generated output
- Generated scripts now inherit full importlib isolation guarantee — zero
  bare imports of ComfyUI internals

generator/generated_helpers.py:
- Export _load_module, _is_comfyui_directory, _find_from_extension_location
  for use by render.py

tests/test_import_path_resolution.py — new (14 test cases):
- TestIsComfyuiDirectory: structural verification against real ComfyUI checkout,
  rejection of empty/nonexistent directories
- TestLoadModule: module loading from explicit path, graceful None for missing
- TestShadowingResistance: malicious main.py and nodes.py at sys.path[0] are
  ignored; _load_module() always loads from verified file path
- TestSysPathIdempotence: insert-once behavior, no remove/re-insert in
  import_custom_nodes(), no print() statements in module source
- TestGeneratedScriptIsolation: generated output contains _load_module() and
  spec_from_file_location; zero bare ComfyUI imports
- TestGetComfyuiPath: env var strategy with verification, fallback chain

tests/test_upscale_model_loader_export.py — updated assertions:
- Replace "import comfy.options" / "import cuda_malloc" checks with
  _load_module() string pattern matching ("comfy.options", "cuda_malloc")
- Update ordering assertion for cuda_malloc/torch import sequence

Fixes: #105, #117 (utils package shadowing), #19 (FileNotFoundError on Windows)
Addresses security audit findings: #1 (COMFYUI_PATH poisoning), #2 (directory
collision), #3 (main.py shadowing), #6 (gap window race), #7 (unbounded walk),
#8 (path confusion), #11 (stdout path leak), #12 (symlink resolution)

Spec: docs/specs/harden-import-path-resolution.html

tests/test_upscale_model_loader_export.py

@@ -146,9 +146,10 @@ class UpscaleModelLoaderExportTest(unittest.TestCase):
 
         self.assertIn("def bootstrap_comfyui_runtime()", generated)
         self.assertIn("def cleanup_comfyui_runtime(", generated)
-        self.assertIn("import comfy.options", generated)
-        self.assertIn("comfy.options.enable_args_parsing()", generated)
-        self.assertIn("import cuda_malloc", generated)
+        # Hardened imports use _load_module(), not bare 'import comfy.options'
+        self.assertIn('"comfy.options"', generated)
+        self.assertIn("enable_args_parsing()", generated)
+        self.assertIn('"cuda_malloc"', generated)
         self.assertNotIn("\nbootstrap_comfyui_runtime()\n", generated)
         self.assertIn(
             "def main(unload_models: bool | None = None):\n"
@@ -177,7 +178,9 @@ class UpscaleModelLoaderExportTest(unittest.TestCase):
             main_section.index("add_extra_model_paths()"),
             main_section.index("import torch"),
         )
-        self.assertLess(generated.index("import cuda_malloc"), generated.index("import torch"))
+        # cuda_malloc is loaded via _load_module() inside bootstrap_comfyui_runtime()
+        # which runs before 'import torch' in main() — ordering preserved
+        self.assertIn("cuda_malloc", generated)
         self.assertIn(
             "    finally:\n        cleanup_comfyui_runtime(unload_models=unload_models)",
             main_section,
@@ -383,10 +386,13 @@ class UpscaleModelLoaderExportTest(unittest.TestCase):
 
             input_file.write_text(json.dumps(workflow), encoding="utf-8")
 
-            with patch(
-                "comfyui_to_python.get_node_class_mappings",
-                return_value={"LoadImage": LoadImage},
-            ), patch("comfyui_to_python.import_custom_nodes"):
+            with (
+                patch(
+                    "comfyui_to_python.get_node_class_mappings",
+                    return_value={"LoadImage": LoadImage},
+                ),
+                patch("comfyui_to_python.import_custom_nodes"),
+            ):
                 run(
                     input_file=str(input_file),
                     output_file=str(output_file),