part 4 缺陷 2：volatile 空根缺 /app 与 /etc 关键文件

RETEST3 缺陷 2：--volatile=yes 下单元根是基本空的 tmpfs，
/app、/etc/resolv.conf、/etc/hosts、/etc/ssl/certs 全无，
执行器单元路径一律 ENOENT、DNS/TLS 不可用。
- build_nspawn_argv：固定只读绑 --bind-ro=/app 与
  --bind-ro=/etc/ssl/certs；新增 extra_ro_binds 参数
  （单元专属 resolv.conf/hosts 由 run_cell 传进来）。
- prepare_cell_files()：按客机有效 DNS 生成单元专属
  resolv.conf/hosts（/run/chv/resolv.conf.<machine>、
  hosts.<machine>，0644——单元 root 映射为客机 uid 1000，
  0600 的 root 文件单元内读不到；DNS/hosts 不含秘密）。
  客机 resolv.conf 可能是 systemd-resolved stub
  （127.0.0.53），单元内无 resolved，直接绑 stub 即 DNS
  全灭，故过滤 stub 后备选 /run/systemd/resolve/resolv.conf，
  两处都没有即大声失败。nsswitch.conf 故意不绑（客机版
  可能含 resolve 模块；glibc 默认 files+dns 正是单元需要的）。
新测试：CellFilesTest、CellPart4ArgvTest（绑定两法）。
run_cell 接线在缺陷 3 的重写里做。

cloud/tests/test_chv_muse_p2.py

@@ -812,5 +812,83 @@ class CellInitPidPollTest(unittest.TestCase):
             self.assertLess(_time.time() - start, 5.0)
 
 
+class CellPart4ArgvTest(unittest.TestCase):
+    """part 4：volatile 空根补 bind + 唯一身份进 argv。"""
+
+    def test_app_and_ca_bundle_bound_read_only(self):
+        argv = CELL.build_nspawn_argv(["true"])
+        self.assertIn("--bind-ro=/app", argv)
+        self.assertIn("--bind-ro=/etc/ssl/certs", argv)
+        # /app 是只读绑：单元内 python3 /app/host.py 只读，不写。
+        self.assertNotIn("--bind=/app", argv)
+
+    def test_extra_ro_binds(self):
+        argv = CELL.build_nspawn_argv(
+            ["true"], extra_ro_binds=[
+                ("/run/chv/resolv.conf.chv-cell-00", "/etc/resolv.conf"),
+                ("/run/chv/hosts.chv-cell-00", "/etc/hosts")])
+        self.assertIn(
+            "--bind-ro=/run/chv/resolv.conf.chv-cell-00:/etc/resolv.conf",
+            argv)
+        self.assertIn(
+            "--bind-ro=/run/chv/hosts.chv-cell-00:/etc/hosts", argv)
+
+
+
+class CellFilesTest(unittest.TestCase):
+    """part 4：单元专属 resolv.conf/hosts 生成。"""
+
+    def _write(self, path, content):
+        with open(path, "w") as fh:
+            fh.write(content)
+        return path
+
+    def test_resolv_filters_stub_and_falls_back(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            stub = self._write(os.path.join(tmp, "resolv.conf"),
+                               "nameserver 127.0.0.53\n"
+                               "options edns0\n")
+            real = self._write(os.path.join(tmp, "resolved.conf"),
+                               "nameserver 8.8.8.8\n"
+                               "nameserver 1.1.1.1\n")
+            files = CELL.prepare_cell_files(
+                "chv-cell-00", run_dir=tmp, resolv_conf=stub,
+                resolved_conf=real,
+                hosts_file=os.path.join(tmp, "no-hosts"))
+            with open(files["resolv"]) as fh:
+                content = fh.read()
+            self.assertEqual(content,
+                             "nameserver 8.8.8.8\nnameserver 1.1.1.1\n")
+            self.assertNotIn("127.0.0.53", content)
+            with open(files["hosts"]) as fh:
+                self.assertIn("127.0.0.1 localhost", fh.read())
+            self.assertEqual(oct(os.stat(files["resolv"]).st_mode
+                                 & 0o777), "0o644")
+            self.assertEqual(files["gate"],
+                             os.path.join(tmp, ".cell-gate-chv-cell-00"))
+            # gate 文件本身不在这里创建（run_cell 配网后才开门）。
+            self.assertFalse(os.path.exists(files["gate"]))
+
+    def test_resolv_real_servers_used_directly(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            resolv = self._write(os.path.join(tmp, "resolv.conf"),
+                                 "nameserver 8.8.4.4\n")
+            files = CELL.prepare_cell_files(
+                "chv-cell-01", run_dir=tmp, resolv_conf=resolv,
+                resolved_conf=os.path.join(tmp, "missing"),
+                hosts_file=os.path.join(tmp, "missing-hosts"))
+            with open(files["resolv"]) as fh:
+                self.assertEqual(fh.read(), "nameserver 8.8.4.4\n")
+
+    def test_no_dns_anywhere_is_loud(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            with self.assertRaises(RuntimeError):
+                CELL.prepare_cell_files(
+                    "chv-cell-00", run_dir=tmp,
+                    resolv_conf=os.path.join(tmp, "missing"),
+                    resolved_conf=os.path.join(tmp, "missing2"),
+                    hosts_file=os.path.join(tmp, "missing-hosts"))
+
+
 if __name__ == "__main__":
     unittest.main()