packages.py and security_packages.py imported the private _MUSL_TARGETS across modules; make it a public store constant next to ALL_TARGETS. The _pin_tool hash memo is an unrelated optimisation, out of scope here.
hermes pm lock