[SNIP] 

I looked at the import code and I found that it is trivial to block the reading and writing of .pyo files.  I am about to implement that patch for our purposes, thus forcing recompilation of the .py files on each run if so specified.   This will ensure that the application will execute only the code represented by the checked-out .py files.  But it occurred to me that this functionality might be of interest to other people than just us.  I can imagine, for example, that buildbots running the python regression testsuite might be running into problems with stray .pyo files from time to time.