fix(cli): import the sampler in a form the module audit resolves

b4b9308 was committed with two failing tests: the module audit read
`from . import profiling` as an import of the package, called profiling
orphaned, and the committed audit manifest drifted. My check read tail's
exit status, not pytest's. Now a from-import; manifest regenerated (109
load-bearing, 0 orphaned); 1,444 pass with pytest's own exit checked.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

benchmarks/measurements/2026-09-08-module-audit.json

@@ -1,7 +1,7 @@
 {
-  "modules": 117,
+  "modules": 118,
   "counts": {
-    "load_bearing": 108,
+    "load_bearing": 109,
     "standalone_capability": 9
   },
   "orphaned": [],
@@ -699,6 +699,14 @@
         "stage_processors"
       ]
     },
+    {
+      "module": "profiling",
+      "classification": "load_bearing",
+      "reason": "reachable from gate, map_gate, pair_gate or the CLI",
+      "importers": [
+        "cli"
+      ]
+    },
     {
       "module": "provenance",
       "classification": "load_bearing",

src/openultrasast/cli.py

@@ -14,7 +14,7 @@ from pathlib import Path
 from time import perf_counter
 from typing import TYPE_CHECKING, Any
 
-from . import profiling, tool_hunter
+from . import tool_hunter
 from .benchmark import (
     create_benchmark_run,
     evaluate_benchmark,
@@ -61,6 +61,7 @@ from .pairs import (
 )
 from .policy import assert_rules_resolve, load_policy
 from .preprocess import FileTarget, preprocess_repository, write_preprocess_artifact
+from .profiling import start as start_profiling
 from .provenance import fingerprint
 from .rank import rank_obligations, rank_targets, write_rankings
 from .regress import TRIGGERABLE, CandidateVerdict, run_regression, write_verdicts
@@ -243,7 +244,7 @@ def main(argv: list[str] | None = None) -> int:
     # indistinguishable from a run with nothing to report, which is how four PHP investigations were
     # spent reading a later stage's timeout as the cause.
     _configure_logging()
-    profiling.start()  # only when OUSAST_SAMPLE_PROFILE names a file
+    start_profiling()  # only when OUSAST_SAMPLE_PROFILE names a file
     if args.command == "pre-push":
         from .config import PushConfig
         from .push.runner import push, replay