fix(merge): resolve lv↔main semantic conflicts surfaced by the build

Post-merge coherence fixes the conflict-marker resolution alone didn't catch
(only the full build/test gate did):

- hooks.py: post_tool_use_hook had a DUPLICATE stuck_guard kwarg + a duplicated
  K7 docstring/record_tool_result block (both sides added stuck_guard to the same
  signature; git kept both → SyntaxError 'duplicate argument', and the guard was
  fed twice per tool call). Collapsed to one stuck_guard param + one record block.
- pipeline.py: restored 'import subprocess' (main's #623 dropped it when it removed
  the git-config subprocess calls, but lv's A6 code_changed block still calls
  subprocess.run → would NameError at runtime). Also the linter's import-order fix.
- test_pipeline.py: main's test_git_identity_uses_env_vars_not_global_config mocked
  verify_build/verify_lint with a bare bool, but the resolved source keeps lv's
  VerifyOutcome shape (build_outcome.passed) → AttributeError. Fixed both mocks to
  VerifyOutcome(passed=True), matching every other lv pipeline test.

Gates green after: cdk 3207 tests + synth + eslint; agent 1374 tests + ruff + ty
(under AGENT_SESSION_ROLE_ARN set — no ECS hang).

Author: isadeks

agent/src/hooks.py

@@ -1070,11 +1070,6 @@ async def post_tool_use_hook(
     redacted version (steered enforcement — content is sanitized, not
     blocked).
 
-    K7: when a ``stuck_guard`` is supplied, every tool result is recorded so a
-    between-turns hook can detect a repeating failing command (the ABCA-483
-    spin loop) and steer / bail. Recording is best-effort and never alters the
-    screening outcome.
-
     ``progress`` is optional (preserves the Phase 1 test call shape). When
     present, an egress-denial signature in the tool output emits an
     ``egress_denied`` blocker event (#251) — best-effort observability,
@@ -1109,14 +1104,6 @@ async def post_tool_use_hook(
     if not isinstance(tool_response, str):
         tool_response = str(tool_response)
 
-    # K7: feed the stuck-guard (best-effort — a tracking error must never block
-    # the screening path that follows).
-    if stuck_guard is not None:
-        try:
-            stuck_guard.record_tool_result(tool_name, hook_input.get("tool_input"), tool_response)
-        except Exception as exc:
-            log("WARN", f"stuck-guard record raised (ignored): {type(exc).__name__}: {exc}")
-
     # #251: best-effort egress-denial detection. A blocked outbound connection
     # (non-allowlisted host hitting the DNS Firewall, refused connection, name
     # resolution failure) surfaces in the tool's stderr here. Emit an

agent/src/pipeline.py

@@ -6,6 +6,7 @@
 import hashlib
 import inspect
 import os
+import subprocess
 import sys
 import time
 from typing import TYPE_CHECKING

agent/tests/test_pipeline.py

@@ -192,8 +192,8 @@ async def fake_run_agent(_prompt, _system_prompt, config, cwd=None, trajectory=N
 
         with (
             patch("pipeline.ensure_committed", return_value=False),
-            patch("pipeline.verify_build", return_value=True),
-            patch("pipeline.verify_lint", return_value=True),
+            patch("pipeline.verify_build", return_value=VerifyOutcome(passed=True)),
+            patch("pipeline.verify_lint", return_value=VerifyOutcome(passed=True)),
             patch(
                 "pipeline.ensure_pr",
                 return_value="https://github.com/org/repo/pull/1",