Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/capi/src/import.rs`:
- Around line 5-8: The FFI function PyImport_Import dereferences the incoming
pointer name without a null check, causing UB; before the unsafe block that does
(&*name).try_downcast_ref::<PyStr>(vm) add a guard if name.is_null() { return
std::ptr::null_mut(); } (or set an appropriate Python error on the VM and then
return std::ptr::null_mut()) so the function returns a null pointer on invalid
input; update the PyImport_Import implementation (the with_vm closure and the
place where try_downcast_ref and vm.import are called) to early-return when name
is null rather than dereferencing it.