feat: CHV gap fill — worker breakpoint wiring, pool reconcile, per-VM host keys, egress validation, guest build script

Stack: #216 -> #221 -> this. Worker breakpoint branch now calls any
executor providing goal_resume_breakpoint_task (Local keeps its
original path, gateway tasks still loud-fail); WarmPool
reconcile_orphans is called on CHV worker startup and close with
audit-on-failure; per-VM SSH host keys are provisioned before VMM
start via cloud-init NoCloud seed (keyscan kept only as weak
fallback, CHV_HOST_KEY_MODE=provisioned|keyscan); CHV_NET_JSON is
validated in preflight and explicit direct egress is audited;
chv-guest/build.sh is now real steps with --dry-run and fails fast
without /dev/kvm. Tests: new test_chv_gaps.py (18), cloud full
1514 OK (skipped=4). No real VM verification: no KVM host.

cloud/chv/config.py

@@ -106,6 +106,12 @@ def build_chv_config(params, env):
     disk_gb = float(disk_gb_raw) if disk_gb_raw else None
     egress_proxy = env.get("CHV_EGRESS_PROXY")
     allow_direct_egress = env.get("CHV_ALLOW_DIRECT_EGRESS") == "1"
+    host_key_mode = params.get("host_key_mode") \
+        or env.get("CHV_HOST_KEY_MODE") or "keyscan"
+    if host_key_mode not in ("provisioned", "keyscan"):
+        raise ValueError(
+            "CHV_HOST_KEY_MODE 只能是 provisioned 或 keyscan：%s"
+            % host_key_mode)
     task_timeout_raw = env.get("CHV_TASK_TIMEOUT")
     task_timeout = float(task_timeout_raw) \
         if task_timeout_raw else None
@@ -141,6 +147,7 @@ def build_chv_config(params, env):
         max_vms=max_vms, disk_mode=disk_mode, disk_gb=disk_gb,
         egress_proxy=egress_proxy,
         allow_direct_egress=allow_direct_egress,
+        host_key_mode=host_key_mode,
         task_timeout=task_timeout, snapshot_url=snapshot_url,
         warm_pool_size=warm_pool_size, api_timeout=api_timeout,
         ready_timeout=ready_timeout, ready_interval=ready_interval)