polish: PR #838 second-pass nits (non-blocking)

- calculate_cac.py: hoist 'import argparse' to module top per repo convention
- smoke_scripts.py: comment the exit-1-over-exit-3 precedence
- check_paths_allowlist.txt: reword the etc/passwd note ('outside repo root if
  resolved literally', not 'deep checkouts')
- cs-scraping-architect.md: clarify both warning and error share exit 1 — parse
  the JSON status field for the distinction

https://claude.ai/code/session_019AJddAL1NADWMXsy1qNPQF

engineering/universal-scraping-architect/agents/cs-scraping-architect.md

@@ -27,7 +27,7 @@ Data-extraction pipeline architect. Operates the `skills/universal-scraping-arch
    ```bash
    python3 skills/universal-scraping-architect/scripts/validate_extraction.py extracted_output.json --json
    ```
-   Exit 0 = `{"status": "ok"}` → proceed. Exit 1 (`warning` = empty output, `error` = malformed JSON) → fix and re-extract; never deliver. Then check required fields and duplicates against the pipeline spec.
+   Exit 0 = `{"status": "ok"}` → proceed. Exit 1 → fix and re-extract; never deliver (parse the JSON `status` field for the `warning` = empty-output vs `error` = malformed-JSON distinction, since both share exit 1). Then check required fields and duplicates against the pipeline spec.
 6. **Format and deliver:** CSV for tabular data, JSON for nested structures, Markdown (chunked for token limits) for crawled docs. Report row counts and empty-value summary.
 
 ## Refusal & Flag Gates

marketing-skill/skills/marketing-demand-acquisition/scripts/calculate_cac.py

@@ -6,6 +6,7 @@ Calculate blended and channel-specific CAC for marketing campaigns.
 Supports multiple time periods and channel breakdowns.
 """
 
+import argparse
 import sys
 from typing import Dict, List
 
@@ -100,7 +101,6 @@ def main():
     print("Blended Target: <$300")
 
 if __name__ == "__main__":
-    import argparse
     parser = argparse.ArgumentParser(
         description="Calculate blended and channel-specific CAC.",
         formatter_class=argparse.RawDescriptionHelpFormatter,

scripts/check_paths_allowlist.txt

@@ -33,5 +33,6 @@ engineering-team/self-improving-agent/skills/extract/SKILL.md :: docker-m1-fixes
 engineering-team/self-improving-agent/skills/extract/SKILL.md :: api-client-regen/SKILL.md
 
 # Path-traversal attack payload in a pen-testing teaching table, not a real
-# file reference. Resolves to the host /etc/passwd only on deep checkouts.
+# file reference. Would point outside the repo root if resolved literally;
+# allowlisted as a teaching example, not an actual file.
 engineering-team/skills/security-pen-testing/SKILL.md :: ../../../etc/passwd

scripts/smoke_scripts.py

@@ -158,6 +158,8 @@ def main(argv=None):
 
     if failures:
         return 1
+    # Only reached when no --help failures; a real failure (exit 1) takes
+    # precedence over allowlist hygiene (exit 3).
     if stale_exceptions:
         return 3
     return 0