fix(chv-muse-r11fix): authd 层 1 叶子树补 errors.py + stub __init__、层 2 seed 补三键

层 1：真实的 cloud/chv/__init__.py import executor/orphans，拷进
authd 最小叶子树（/usr/local/lib/chv-authd）会让 chv-authd 在
import 时 ModuleNotFoundError 而 crash loop——先是 errors.py
缺失，补上后又在 executor 上失败（探针 fixprobe3）。新增
chv-guest/authd_init_stub.py（仅导出 ChvFailure），build.sh 拷
errors.py + stub 作叶子树的 __init__.py，不再拷真实包 __init__；
P3_LIBS_PRESENT 条件加 errors.py；EXTRA_CONTENTS 加 errors.py 与
__init__.py；两 lockfile 脚本的 DECLARED_SOURCES 同款登记。
层 2：_seed_env_entries 把 guest-env 里的
GITEA_URL/GITEA_USER/SYNC_REPO 抄进 authd-seed（build_server
要求四键齐全，只 GITEA_TOKEN 即 ValueError）；没有不补、不编
默认值。测试：seed 三键落盘/缺键不补、干跑夹具含新文件、lockfile
合成清单含新两项。

cloud/chv/hostkeys.py

@@ -193,10 +193,16 @@ def build_seed_user_data(private_key_text: str, public_key_text: str) -> str:
 
 def _authd_env_entry(authd_env: dict) -> list:
     """authd-seed 的 write_files 条目行（0600 root，值经
-    shlex.quote 引用）：只装 AUTHD_SECRET_KEYS 命中的密钥，
-    与 guest-env 条目并列写进同一 write_files 列表（绝不另写
-    一个 write_files: 键，见 _guest_env_entry 的 YAML 重复键
-    禁令）。"""
+    shlex.quote 引用）：装 AUTHD_SECRET_KEYS 命中的密钥
+    （本期只有 GITEA_TOKEN），外加与 guest-env 同源抄进来的
+    三个非密钥同步变量（GITEA_URL/GITEA_USER/SYNC_REPO——
+    round-11 真机修复层 2：authd 的 build_server 要求 seed
+    里同时有这三键，只 GITEA_TOKEN 会 ValueError；探针
+    fixprobe3 即从 guest-env 补这三键）。三键只在调用方
+    guest-env 里有才抄，没有不补、不编默认值；与 guest-env
+    条目并列写进同一 write_files 列表（绝不另写一个
+    write_files: 键，见 _guest_env_entry 的 YAML 重复键禁令）。
+    """
     lines = [
         "  - path: %s" % AUTHD_SEED_PATH,
         "    permissions: '0600'",
@@ -296,12 +302,18 @@ def _write_seed_meta(seed_dir: str, vm_name: str) -> str:
 def _seed_env_entries(merged_env: dict,
                       authd_env: dict | None) -> list:
     """guest-env 与 authd-seed 两路的 write_files 条目行
-    （皆空即空列表，不写条目）。"""
+    （皆空即空列表，不写条目）。authd-seed 除了密钥还抄
+    guest-env 里的 GITEA_URL/GITEA_USER/SYNC_REPO（层 2，
+    见 _authd_env_entry）——build_server 要求四键齐全。"""
     extra_lines = []
     if merged_env:
         extra_lines += _guest_env_entry(merged_env)
     if authd_env:
-        extra_lines += _authd_env_entry(authd_env)
+        seed_env = dict(authd_env)
+        for key in ("GITEA_URL", "GITEA_USER", "SYNC_REPO"):
+            if key in merged_env:
+                seed_env[key] = merged_env[key]
+        extra_lines += _authd_env_entry(seed_env)
     return extra_lines
 
 

cloud/tests/test_chv_muse_p2.py

@@ -575,13 +575,14 @@ class BuildDryRunTest(unittest.TestCase):
                          "generate_lockfile.py", "chv-sync.sh",
                          "chv-cell.py", "chv-broker.py", "chv-browser.py",
                          "authd.py", "git-credential-chv-authd",
-                         "chv-authd.service"):
+                         "chv-authd.service", "authd_init_stub.py"):
                 shutil.copy2(ROOT / "chv-guest" / name,
                              os.path.join(guest, name))
             shutil.copy2(ROOT / "host.py", os.path.join(repo, "host.py"))
             # round-11：build.sh 要求 P3 云端叶子模块在仓里（fail-fast），
             # 夹具须一并拷入，否则干跑在 P3 预检就失败。
             for rel in ("cloud/chv/authd.py", "cloud/chv/sentinel.py",
+                        "cloud/chv/errors.py",
                         "cloud/__init__.py", "cloud/chv/__init__.py"):
                 dest = os.path.join(repo, rel)
                 os.makedirs(os.path.dirname(dest), exist_ok=True)
@@ -623,7 +624,11 @@ class BuildDryRunTest(unittest.TestCase):
                            "systemctl enable chv-broker chv-browser",
                            "chv-authd", "git-credential-chv-authd",
                            "systemctl enable chv-authd",
-                           "systemctl start chv-authd"):
+                           "systemctl start chv-authd",
+                           # round-11 真机修复（层 1）：叶子树含
+                           # errors.py + stub __init__，不拷真实的
+                           # cloud/chv/__init__.py。
+                           "errors.py", "authd_init_stub.py"):
                 self.assertIn(needle, out, needle)
             # P1 文件不在本分支：干跑只警告、不失败。
             self.assertIn("vsock_notify.py 不在仓库里", out)

cloud/tests/test_chv_muse_p3.py

@@ -367,6 +367,49 @@ class SeedSplitTest(unittest.TestCase):
         self.assertNotIn("GITEA_TOKEN",
                          entries["/etc/chv/guest-env"]["content"])
 
+    def test_write_seed_authd_entry_carries_sync_keys(self):
+        # round-11 真机修复（层 2）：authd-seed 须同时有
+        # GITEA_URL/GITEA_USER/SYNC_REPO，build_server 才会放行
+        #（只 GITEA_TOKEN 时 ValueError，探针 fixprobe3 即从
+        # guest-env 补这三键）；三键只在 guest-env 里有才抄。
+        import yaml
+        with tempfile.TemporaryDirectory() as tmp:
+            seed_dir = os.path.join(tmp, "seed")
+            write_seed(seed_dir, "vm1", "PRIV", "ssh-ed25519 AAAAx",
+                       guest_env={
+                           "GITEA_URL": "https://gitea.tose.top",
+                           "GITEA_USER": "admin",
+                           "SYNC_REPO": "admin/chv-sync-test",
+                           "SYNC_BRANCH": "main"},
+                       authd_env={"GITEA_TOKEN": TOKEN})
+            with open(os.path.join(seed_dir, "user-data")) as fh:
+                parsed = yaml.safe_load(fh.read())
+        entries = {e["path"]: e for e in parsed["write_files"]}
+        content = entries[AUTHD_SEED_PATH]["content"]
+        for key in ("GITEA_URL=https://gitea.tose.top",
+                    "GITEA_USER=admin",
+                    "SYNC_REPO=admin/chv-sync-test",
+                    "GITEA_TOKEN="):
+            self.assertIn(key, content)
+        # 非同步键不进 authd-seed。
+        self.assertNotIn("SYNC_BRANCH", content)
+
+    def test_write_seed_authd_entry_without_sync_keys(self):
+        # guest-env 里没有三键时 authd-seed 只装密钥，不编默认值。
+        import yaml
+        with tempfile.TemporaryDirectory() as tmp:
+            seed_dir = os.path.join(tmp, "seed")
+            write_seed(seed_dir, "vm1", "PRIV", "ssh-ed25519 AAAAx",
+                       authd_env={"GITEA_TOKEN": TOKEN})
+            with open(os.path.join(seed_dir, "user-data")) as fh:
+                parsed = yaml.safe_load(fh.read())
+        entries = {e["path"]: e for e in parsed["write_files"]}
+        content = entries[AUTHD_SEED_PATH]["content"]
+        self.assertIn("GITEA_TOKEN=", content)
+        self.assertNotIn("GITEA_URL", content)
+        self.assertNotIn("GITEA_USER", content)
+        self.assertNotIn("SYNC_REPO", content)
+
 
 # -- (4) wake 预审 -----------------------------------------------------------
 class _FakeResult:

cloud/tests/test_chv_residual.py

@@ -437,11 +437,14 @@ class LockfileTest(unittest.TestCase):
                          # P2 三件套 + P3 authd 三件套 + 叶子模块 +
                          # vsock_notify（缺 DECLARED_SOURCES 登记时
                          # generate 记 unresolved、verify/check 失败，
-                         # 合成清单须覆盖才拦得住回归）。
+                         # 合成清单须覆盖才拦得住回归）。round-11
+                         # 真机修复（层 1）后叶子模块还含 errors.py
+                         # 与 stub __init__.py。
                          "systemd-container", "chv-cell", "chv-broker",
                          "chv-browser", "chv-authd",
                          "git-credential-chv-authd", "chv-authd.service",
                          "cloud/chv/authd.py", "cloud/chv/sentinel.py",
+                         "cloud/chv/errors.py", "cloud/chv/__init__.py",
                          "vsock_notify",
                          "playwright", "chromium-headless-shell"],
             "versions": {"dpkg": dpkg,