Follow-up to #67640: move the agent.file_safety import to module top (stdlib-only, no circular-import concern), replace the over-broad except Exception + logger.warning with an import sentinel plus logger.exception so a guard failure is debuggable instead of silently swallowed. Adds fail-closed tests asserting the diagnostic is emitted.