fix(pathfinder): satisfy canary probe pre-commit hooks

Mark the intentional subprocess launches as trusted inputs for Ruff's bandit checks and keep the affected files in hook-compliant import/format order.

Made-with: Cursor

Author: cpcloud

cuda_pathfinder/cuda/pathfinder/_dynamic_libs/canary_probe_subprocess.py

@@ -2,9 +2,9 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
+import json
 import sys
 from collections.abc import Sequence
-import json
 
 from cuda.pathfinder._dynamic_libs.lib_descriptor import LIB_DESCRIPTORS
 from cuda.pathfinder._dynamic_libs.load_dl_common import DynamicLibNotFoundError, LoadedDL

cuda_pathfinder/cuda/pathfinder/_dynamic_libs/load_nvidia_dynamic_lib.py

@@ -96,7 +96,7 @@ def _raise_canary_probe_child_process_error(
 def _resolve_system_loaded_abs_path_in_subprocess(libname: str) -> str | None:
     """Resolve a canary library's absolute path in a fresh Python subprocess."""
     try:
-        result = subprocess.run(
+        result = subprocess.run(  # noqa: S603 - trusted argv: current interpreter + internal probe module
             [sys.executable, "-m", _CANARY_PROBE_MODULE, libname],
             capture_output=True,
             text=True,

cuda_pathfinder/tests/test_ctk_root_discovery.py

@@ -289,12 +289,10 @@ def test_subprocess_probe_does_not_reenter_calling_script(tmp_path):
     env = os.environ.copy()
     existing_pythonpath = env.get("PYTHONPATH")
     env["PYTHONPATH"] = (
-        str(_PACKAGE_ROOT)
-        if not existing_pythonpath
-        else os.pathsep.join((str(_PACKAGE_ROOT), existing_pythonpath))
+        str(_PACKAGE_ROOT) if not existing_pythonpath else os.pathsep.join((str(_PACKAGE_ROOT), existing_pythonpath))
     )
 
-    result = subprocess.run(
+    result = subprocess.run(  # noqa: S603 - trusted argv: current interpreter + temp script created by this test
         [sys.executable, str(script_path)],
         capture_output=True,
         text=True,