security: bump nltk to >=3.10.0 in iheval and rolemrc - #2256

nltk>=3.9 installs NLTKSafeImportFinder which blocks any import initiated
by nltk if the module path is inside CWD. Server venvs live inside the repo
root, so site-packages are flagged as "in the CWD" — even though they are
legitimate installed packages. PYTHONSAFEPATH does not help because the check
is on the resolved path, not on sys.path membership.

Importing regex at module load (before rouge_score triggers the nltk import
chain) puts it in sys.modules. Python then returns the cached module on the
second import without calling any meta_path finders, bypassing the block.

Also reverts the PYTHONSAFEPATH=1 workflow addition from the previous commit
since it does not fix the underlying issue.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

The import is a side-effect import to pre-load regex into sys.modules
before nltk installs its inisec.py finder. noqa: F401 tells ruff not
to remove it as unused.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

nltk.corpus.reader.api imports defusedxml at module level, so it gets
blocked by nltk's inisec.py finder for the same reason as regex.
Pre-importing it before the rouge_score/nltk import chain fires puts it
in sys.modules and bypasses the check.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

nltk.corpus.reader.api imports defusedxml.ElementTree specifically, not
just the top-level defusedxml package. Pre-importing the submodule puts
both defusedxml and defusedxml.ElementTree into sys.modules before nltk's
inisec.py finder can block them.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

Allows manual triggering of the full sharded server suite for validation
on security/dependency bump PRs without requiring core-file changes.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

…defusedxml.ElementTree

The same nltk>=3.9 inisec.py false-positive that affected iheval and rolemrc
also affects any server whose import chain reaches nltk — either directly
(ifbench has nltk in requirements) or transitively via rouge-score
(toolsandbox) or verifiable-instructions (instruction_following).

Pre-importing regex and defusedxml.ElementTree at module load time puts them
in sys.modules before nltk's NLTKSafeImportFinder is installed, bypassing
the block.

Verified locally: ifbench 15/15, instruction_following 15/15 passed.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

ifbench: conftest.py calls ensure_ifbench() -> _ensure_nltk_data() ->
import nltk before app.py's pre-imports run, so the NLTKSafeImportFinder
was installed before regex/defusedxml were in sys.modules. The punkt
download inside _ensure_nltk_data() then failed silently (caught by
except Exception), leaving punkt absent. Tests timed out downloading
punkt inline. Fix: pre-import regex and defusedxml.ElementTree at the
top of conftest.py, before ensure_ifbench() is called.

tau2: regenerate test_data.json snapshot — the previous snapshot
included a review_model config field that was removed from the tau2
agent config, causing test_sanity_query_input to fail.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

… regex)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

…itive

The regenerated snapshot used indent=4 which placed the dummy api_key
field at line 1070, triggering detect-secrets. Match the original
single-line compact format to avoid the false positive.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

The previous snapshot regeneration was unnecessary — the original file
passes the test locally with the current tau2-bench. The CI failure was
due to tau2-bench version drift, not a content mismatch in the snapshot.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

…into security/bump-nltk-cve-jul2026

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Kajal Jain <kajalj@nvidia.com>