The dependency boundary needs a check on introduced imports as well as a diff of pyproject.toml. An agent can add an import for an undeclared package without changing that file, so the described manifest diff would stay empty while the actual code crosses the boundary.

I would compare newly introduced import roots with the standard library and an explicit mapping of allowed distribution names to import names. Test a declared dependency, an undeclared dependency, and a package whose distribution name differs from its module name. That keeps the refusal deterministic while avoiding both a missed crossing and a false escalation caused by naming differences.