Whitelist argparse and getopt as safe modules

[crowcreation]

Summary

Move argparse and getopt from DANGEROUS_MODULES to SAFE_MODULES in the Python handler. Both are pure argv-parsing stdlib modules whose only side effects are stdout/stderr text and sys.exit on bad args — none of which is in the analyser's threat model:

• print is already whitelisted, so --help/error text to stdout/stderr is consistent with existing policy.
• sys.exit just terminates the script — not code execution, file I/O, or network access.
• Neither module can read/write files, open sockets, spawn processes, or touch the filesystem.

Motivation

Nearly every real-world CLI script imports argparse. Listing it as dangerous caused the static analyser to ask for approval on essentially every script the handler sees — defeating the handler's purpose of auto-approving provably safe code. I hit this constantly with my own CLI tooling under scripts/, which prompted a dig through python.py.

What is deliberately NOT changed

• logging — real FileHandler/SocketHandler/SMTPHandler exist
• sys — sys.modules manipulation, sys.stdin/sys.stdout usable as file objects
• getpass — reads from tty (I/O)
• atexit — enables deferred execution of unreviewed handlers

These retain defensible I/O or exec vectors and stay in DANGEROUS_MODULES.

Test plan

• Added test_safe_script_argparse_approved and test_safe_script_getopt_approved in TestPythonScriptAnalysis, mirroring existing safe-import test style.
• Full tests/cli/test_python.py suite (127 tests) passes on Python 3.14 via uv run.
• Existing dangerous-import tests (os, subprocess, pathlib, socket, requests, etc.) unaffected.