feat(chv-muse-round11): build.sh 补 P3 authd 进镜像 + gt 脚本哈希轮换

- authd 三件套 copy-in（chv-guest/authd.py 与 git-credential-chv-authd
  -> /usr/local/bin/ 并 chmod +x，chv-authd.service ->
  /etc/systemd/system/），云端叶子模块 cloud/chv/authd.py 与
  sentinel.py + 两个 __init__.py -> /usr/local/lib/chv-authd/，
  systemctl enable chv-authd；99-chv-sync.cfg runcmd 在 chv-sync
  boot 之前加 systemctl start chv-authd；缺件即 fail-fast
- buildinfo BASE_CONTENTS 登记新增件；P2 干跑夹具补 P3 文件并断言
  authd 步骤出现在干跑输出里
- GT_INSTALL_SH_SHA256 cf82... -> 49ffe090...：上游 2026-11-07
  06:44 轮换，V-9 已核实（WSL fresh curl 与失败镜像内残留逐字节
  一致；新脚本全文已读，只从 dl.gitea.com 取 1.0.0 二进制并验 hash）
- vsock_notify 条件拷入在合入后生效（cloud/chv/guest/vsock_notify.py
  已在仓里，干跑不再报缺失警告）
- 定向单测 P1/P2/P3/chv_fix 172 项全过；全量套件仍在跑

cloud/tests/test_chv_muse_p2.py

@@ -568,10 +568,19 @@ class BuildDryRunTest(unittest.TestCase):
             os.makedirs(os.path.join(bindir, "codex-resources"))
             for name in ("build.sh", "buildinfo.py", "check_lockfile.py",
                          "generate_lockfile.py", "chv-sync.sh",
-                         "chv-cell.py", "chv-broker.py", "chv-browser.py"):
+                         "chv-cell.py", "chv-broker.py", "chv-browser.py",
+                         "authd.py", "git-credential-chv-authd",
+                         "chv-authd.service"):
                 shutil.copy2(ROOT / "chv-guest" / name,
                              os.path.join(guest, name))
             shutil.copy2(ROOT / "host.py", os.path.join(repo, "host.py"))
+            # round-11：build.sh 要求 P3 云端叶子模块在仓里（fail-fast），
+            # 夹具须一并拷入，否则干跑在 P3 预检就失败。
+            for rel in ("cloud/chv/authd.py", "cloud/chv/sentinel.py",
+                        "cloud/__init__.py", "cloud/chv/__init__.py"):
+                dest = os.path.join(repo, rel)
+                os.makedirs(os.path.dirname(dest), exist_ok=True)
+                shutil.copy2(ROOT / rel, dest)
             codex = os.path.join(bindir, "codex")
             with open(codex, "w") as fh:
                 fh.write("#!/bin/sh\necho 'codex-cli 0.164.0-alpha.9'\n")
@@ -606,7 +615,10 @@ class BuildDryRunTest(unittest.TestCase):
             for needle in ("systemd-container", "chv-cell", "chv-broker",
                            "chv-browser", "chv-browser.service",
                            "chv-broker.service", "useradd --system",
-                           "systemctl enable chv-broker chv-browser"):
+                           "systemctl enable chv-broker chv-browser",
+                           "chv-authd", "git-credential-chv-authd",
+                           "systemctl enable chv-authd",
+                           "systemctl start chv-authd"):
                 self.assertIn(needle, out, needle)
             # P1 文件不在本分支：干跑只警告、不失败。
             self.assertIn("vsock_notify.py 不在仓库里", out)