feat(chv-guest): M4 Chromium 单独钉死 + /app 收紧为最小集

- Chromium 钉死：CHROMIUM_HEADLESS_SHELL_REV（纯数字修订号）
  设即钉死，buildinfo.py 校验读回的 ms-playwright 缓存目录名
  须恰好是该修订号，否则构建失败；generate/check 的 --verify
  也复核；未设时只记录、构建输出明说未钉死，BUILDINFO 记 null
- /app 最小集：build.sh 不再把整个 $REPO_DIR/cloud/ 拷进客机，
  只拷 host.py（只用标准库，不依赖 cloud/）；REPO_DIR 预检
  不再要求 cloud/ 存在
- generate_lockfile.py 只读 BUILDINFO.versions 一事已在 to10 轨
  改写，本棒以合成 BUILDINFO 干跑复核（假版本 9.9.9 进 lockfile，
  宿主 git 1:2.43.0 未混入）并补钉死复核；真实 lockfile 产出
  仍待 V-9 真机构建，不编造版本号

chv-guest/buildinfo.py

@@ -11,6 +11,14 @@ sha256/size 是对产物文件实测的；image_sha256 即 disk.raw
 用法：
   python3 buildinfo.py OUT_DIR TAG UBUNTU CODEX_VERSION \\
       REPO_COMMIT UBUNTU_IMAGE_SHA256 PLAYWRIGHT(0|1)
+      [CHROMIUM_HEADLESS_SHELL_REV]
+
+CHROMIUM_HEADLESS_SHELL_REV（可选，纯数字）：钉死的
+ms-playwright 缓存修订号（如 1248）。PLAYWRIGHT=1 且
+给了该值时，versions.chromium 里须恰好出现
+chromium_headless_shell-<rev>，否则退出 1、构建失败；
+未给时只记录、不强制，BUILDINFO.chromium_pinned_rev
+记 null，构建输出由 build.sh 明说“未钉死”。
 """
 import hashlib
 import json
@@ -59,7 +67,7 @@ def _sha256_size(path):
 
 
 def build(outdir, tag, ubuntu, codex_version, repo_commit,
-          ubuntu_image_sha256, playwright):
+          ubuntu_image_sha256, playwright, chromium_pinned_rev=None):
     disk_path = os.path.join(outdir, "disk.raw")
     vmlinux_path = os.path.join(outdir, "vmlinux")
     disk_sha, disk_size = _sha256_size(disk_path)
@@ -98,6 +106,9 @@ def build(outdir, tag, ubuntu, codex_version, repo_commit,
         "playwright": bool(playwright),
         "playwright_browsers_path": PLAYWRIGHT_BROWSERS_PATH
         if playwright else "",
+        # feat-chv-closeup（M4）：钉死的 Chromium 修订号（未设
+        # 记 null，绝不编一个默认值出来假装已钉死）。
+        "chromium_pinned_rev": chromium_pinned_rev or None,
         "image_sha256": disk_sha,
         "artifacts": {
             "disk.raw": {"sha256": disk_sha, "size": disk_size},
@@ -112,15 +123,22 @@ def build(outdir, tag, ubuntu, codex_version, repo_commit,
 
 
 def main(argv):
-    if len(argv) != 8:
+    if len(argv) not in (8, 9):
         print("用法：buildinfo.py OUT TAG UBUNTU CODEX_VERSION "
-              "REPO_COMMIT UBUNTU_IMAGE_SHA256 PLAYWRIGHT",
-              file=sys.stderr)
+              "REPO_COMMIT UBUNTU_IMAGE_SHA256 PLAYWRIGHT "
+              "[CHROMIUM_HEADLESS_SHELL_REV]", file=sys.stderr)
         return 2
     _, outdir, tag, ubuntu, codex_version, repo_commit, \
-        ubuntu_image_sha256, playwright = argv
+        ubuntu_image_sha256, playwright = argv[:8]
+    chromium_pinned_rev = argv[8] if len(argv) == 9 else None
+    if chromium_pinned_rev and not re.fullmatch(r"[0-9]+",
+                                                chromium_pinned_rev):
+        print("CHROMIUM_HEADLESS_SHELL_REV 须为纯数字：%s"
+              % chromium_pinned_rev, file=sys.stderr)
+        return 2
     info = build(outdir, tag, ubuntu, codex_version, repo_commit,
-                 ubuntu_image_sha256, playwright == "1")
+                 ubuntu_image_sha256, playwright == "1",
+                 chromium_pinned_rev)
     if not info["versions"]["dpkg"]:
         print("BUILDINFO versions.dpkg 为空", file=sys.stderr)
         return 1
@@ -134,6 +152,16 @@ def main(argv):
         print("BUILDINFO versions.chromium 为空（浏览器未装好或"
               "读回路径不对）", file=sys.stderr)
         return 1
+    if playwright == "1" and chromium_pinned_rev:
+        # feat-chv-closeup（M4）：钉死校验——读回的缓存目录名
+        # 须恰好是该修订号，playwright 升级导致目录名变了就
+        # 在这里失败，不静默换浏览器版本。
+        expected = "chromium_headless_shell-%s" % chromium_pinned_rev
+        if expected not in (info["versions"].get("chromium") or []):
+            print("Chromium 修订号与钉死值不符：读回 %s，钉死 %s"
+                  % (info["versions"].get("chromium"), expected),
+                  file=sys.stderr)
+            return 1
     if info["tag"] != tag:
         print("BUILDINFO tag 不一致", file=sys.stderr)
         return 1