round-12: ruff hygiene on migration code (import sort, narrow store except)

- test_chv_muse_round12.py: drop unused socket/time imports, drop
  unnecessary sys.path.insert (P3 pattern needs none), sort method-local
  imports (activity/capabilities, approval_card/channel/sentinel)
- audit_trail.py: single-line method-local imports (I001)
- swarm.py / presentation.py / browser_tasks.py: store-path fail-safe
  except narrowed from bare Exception to (sqlite3.Error, OSError)
  (DB/file failures only); transport spawn/ping/close handlers in
  browser_tasks.py deliberately stay bare Exception (arbitrary
  transport errors must map to failed/False/close_error)
- NOT fixed (pre-existing style, left as-is): UP031 % formatting
  (used throughout the codebase incl. the copied lines), BLE001/
  TRY004 in untouched code, F401 atomic_write + RUF059 swarm
  (P7/P8 pre-existing)

cloud/tests/test_chv_muse_round12.py

@@ -15,18 +15,14 @@
 import importlib.util
 import json
 import os
-import socket
 import sqlite3
 import subprocess
-import sys
 import tempfile
 import threading
-import time
 import unittest
 from pathlib import Path
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
-sys.path.insert(0, str(REPO_ROOT))
 
 from cloud.chv.app_state import AppStateStore, host_state_db_path
 from cloud.chv.audit_trail import (
@@ -34,16 +30,16 @@ from cloud.chv.audit_trail import (
     StoreAuditTrail,
     migrate_jsonl_to_store,
 )
-from cloud.chv.swarm import (
-    create_swarm,
-    get_swarm,
-)
-from cloud.chv.presentation import NotificationLedger
 from cloud.chv.browser_tasks import (
     BrowserTransport,
     create_instance,
     get_instance,
 )
+from cloud.chv.presentation import NotificationLedger
+from cloud.chv.swarm import (
+    create_swarm,
+    get_swarm,
+)
 
 TOKEN = "fake-token-123"
 T0 = 1700000000.0
@@ -471,12 +467,12 @@ class P12DictContractTest(unittest.TestCase):
     """P12 接线用真实 P3/P5 代码，不用替身。"""
 
     def test_approval_card_from_real_p3_queue(self):
-        from cloud.chv.sentinel import ApprovalQueue, EgressRequest
         from cloud.chv.approval_card import (
             build_approval_card,
             card_matches_channel,
         )
         from cloud.chv.approval_channel import request_approval
+        from cloud.chv.sentinel import ApprovalQueue, EgressRequest
         queue = ApprovalQueue(clock=lambda: T0)
         req = EgressRequest("gitea", "POST", "https",
                             "gitea.tose.top", 443,
@@ -496,8 +492,8 @@ class P12DictContractTest(unittest.TestCase):
             card_matches_channel(card, channel.payload()))
 
     def test_permission_registry_from_real_p5_describe(self):
-        from cloud.chv.capabilities import CapabilityIssuer
         from cloud.chv.activity import PermissionRegistry
+        from cloud.chv.capabilities import CapabilityIssuer
         issuer = CapabilityIssuer(clock=lambda: T0)
         cap = issuer.issue(
             "one-shot", "gitea", "gitea.tose.top", ["GET"],