feat(chv-guest): M4 Chromium 单独钉死 + /app 收紧为最小集

- Chromium 钉死：CHROMIUM_HEADLESS_SHELL_REV（纯数字修订号）
  设即钉死，buildinfo.py 校验读回的 ms-playwright 缓存目录名
  须恰好是该修订号，否则构建失败；generate/check 的 --verify
  也复核；未设时只记录、构建输出明说未钉死，BUILDINFO 记 null
- /app 最小集：build.sh 不再把整个 $REPO_DIR/cloud/ 拷进客机，
  只拷 host.py（只用标准库，不依赖 cloud/）；REPO_DIR 预检
  不再要求 cloud/ 存在
- generate_lockfile.py 只读 BUILDINFO.versions 一事已在 to10 轨
  改写，本棒以合成 BUILDINFO 干跑复核（假版本 9.9.9 进 lockfile，
  宿主 git 1:2.43.0 未混入）并补钉死复核；真实 lockfile 产出
  仍待 V-9 真机构建，不编造版本号

chv-guest/generate_lockfile.py

@@ -145,6 +145,21 @@ def verify(lockfile_path, buildinfo_path):
                   % (lockfile.get("tag"), buildinfo.get("tag")),
                   file=sys.stderr)
             return 1
+        # feat-chv-closeup（M4）：钉死的 Chromium 修订号须与
+        # lockfile 里记的 chromium-headless-shell 条目一致；
+        # BUILDINFO 没钉（pinned_rev 为空）时不校验。
+        pinned = buildinfo.get("chromium_pinned_rev")
+        if pinned:
+            expected = "chromium_headless_shell-%s" % pinned
+            declared = (lockfile.get("versions") or {}).get(
+                "declared") or []
+            hit = [e for e in declared
+                   if str(e).startswith("chromium-headless-shell ")]
+            if not hit or expected not in str(hit[0]):
+                print("Chromium 修订号与钉死值不符：lockfile %s，"
+                      "钉死 chromium_headless_shell-%s"
+                      % (hit, pinned), file=sys.stderr)
+                return 1
     versions = lockfile.get("versions") or {}
     for kind in ("dpkg", "pip"):
         entries = versions.get(kind)