fix(chv-muse-r11fix): authd 层 1 叶子树补 errors.py + stub __init__、层 2 seed 补三键

层 1：真实的 cloud/chv/__init__.py import executor/orphans，拷进
authd 最小叶子树（/usr/local/lib/chv-authd）会让 chv-authd 在
import 时 ModuleNotFoundError 而 crash loop——先是 errors.py
缺失，补上后又在 executor 上失败（探针 fixprobe3）。新增
chv-guest/authd_init_stub.py（仅导出 ChvFailure），build.sh 拷
errors.py + stub 作叶子树的 __init__.py，不再拷真实包 __init__；
P3_LIBS_PRESENT 条件加 errors.py；EXTRA_CONTENTS 加 errors.py 与
__init__.py；两 lockfile 脚本的 DECLARED_SOURCES 同款登记。
层 2：_seed_env_entries 把 guest-env 里的
GITEA_URL/GITEA_USER/SYNC_REPO 抄进 authd-seed（build_server
要求四键齐全，只 GITEA_TOKEN 即 ValueError）；没有不补、不编
默认值。测试：seed 三键落盘/缺键不补、干跑夹具含新文件、lockfile
合成清单含新两项。

cloud/tests/test_chv_muse_p2.py

@@ -575,13 +575,14 @@ class BuildDryRunTest(unittest.TestCase):
                          "generate_lockfile.py", "chv-sync.sh",
                          "chv-cell.py", "chv-broker.py", "chv-browser.py",
                          "authd.py", "git-credential-chv-authd",
-                         "chv-authd.service"):
+                         "chv-authd.service", "authd_init_stub.py"):
                 shutil.copy2(ROOT / "chv-guest" / name,
                              os.path.join(guest, name))
             shutil.copy2(ROOT / "host.py", os.path.join(repo, "host.py"))
             # round-11：build.sh 要求 P3 云端叶子模块在仓里（fail-fast），
             # 夹具须一并拷入，否则干跑在 P3 预检就失败。
             for rel in ("cloud/chv/authd.py", "cloud/chv/sentinel.py",
+                        "cloud/chv/errors.py",
                         "cloud/__init__.py", "cloud/chv/__init__.py"):
                 dest = os.path.join(repo, rel)
                 os.makedirs(os.path.dirname(dest), exist_ok=True)
@@ -623,7 +624,11 @@ class BuildDryRunTest(unittest.TestCase):
                            "systemctl enable chv-broker chv-browser",
                            "chv-authd", "git-credential-chv-authd",
                            "systemctl enable chv-authd",
-                           "systemctl start chv-authd"):
+                           "systemctl start chv-authd",
+                           # round-11 真机修复（层 1）：叶子树含
+                           # errors.py + stub __init__，不拷真实的
+                           # cloud/chv/__init__.py。
+                           "errors.py", "authd_init_stub.py"):
                 self.assertIn(needle, out, needle)
             # P1 文件不在本分支：干跑只警告、不失败。
             self.assertIn("vsock_notify.py 不在仓库里", out)

cloud/tests/test_chv_muse_p3.py

@@ -367,6 +367,49 @@ class SeedSplitTest(unittest.TestCase):
         self.assertNotIn("GITEA_TOKEN",
                          entries["/etc/chv/guest-env"]["content"])
 
+    def test_write_seed_authd_entry_carries_sync_keys(self):
+        # round-11 真机修复（层 2）：authd-seed 须同时有
+        # GITEA_URL/GITEA_USER/SYNC_REPO，build_server 才会放行
+        #（只 GITEA_TOKEN 时 ValueError，探针 fixprobe3 即从
+        # guest-env 补这三键）；三键只在 guest-env 里有才抄。
+        import yaml
+        with tempfile.TemporaryDirectory() as tmp:
+            seed_dir = os.path.join(tmp, "seed")
+            write_seed(seed_dir, "vm1", "PRIV", "ssh-ed25519 AAAAx",
+                       guest_env={
+                           "GITEA_URL": "https://gitea.tose.top",
+                           "GITEA_USER": "admin",
+                           "SYNC_REPO": "admin/chv-sync-test",
+                           "SYNC_BRANCH": "main"},
+                       authd_env={"GITEA_TOKEN": TOKEN})
+            with open(os.path.join(seed_dir, "user-data")) as fh:
+                parsed = yaml.safe_load(fh.read())
+        entries = {e["path"]: e for e in parsed["write_files"]}
+        content = entries[AUTHD_SEED_PATH]["content"]
+        for key in ("GITEA_URL=https://gitea.tose.top",
+                    "GITEA_USER=admin",
+                    "SYNC_REPO=admin/chv-sync-test",
+                    "GITEA_TOKEN="):
+            self.assertIn(key, content)
+        # 非同步键不进 authd-seed。
+        self.assertNotIn("SYNC_BRANCH", content)
+
+    def test_write_seed_authd_entry_without_sync_keys(self):
+        # guest-env 里没有三键时 authd-seed 只装密钥，不编默认值。
+        import yaml
+        with tempfile.TemporaryDirectory() as tmp:
+            seed_dir = os.path.join(tmp, "seed")
+            write_seed(seed_dir, "vm1", "PRIV", "ssh-ed25519 AAAAx",
+                       authd_env={"GITEA_TOKEN": TOKEN})
+            with open(os.path.join(seed_dir, "user-data")) as fh:
+                parsed = yaml.safe_load(fh.read())
+        entries = {e["path"]: e for e in parsed["write_files"]}
+        content = entries[AUTHD_SEED_PATH]["content"]
+        self.assertIn("GITEA_TOKEN=", content)
+        self.assertNotIn("GITEA_URL", content)
+        self.assertNotIn("GITEA_USER", content)
+        self.assertNotIn("SYNC_REPO", content)
+
 
 # -- (4) wake 预审 -----------------------------------------------------------
 class _FakeResult:

cloud/tests/test_chv_residual.py

@@ -437,11 +437,14 @@ class LockfileTest(unittest.TestCase):
                          # P2 三件套 + P3 authd 三件套 + 叶子模块 +
                          # vsock_notify（缺 DECLARED_SOURCES 登记时
                          # generate 记 unresolved、verify/check 失败，
-                         # 合成清单须覆盖才拦得住回归）。
+                         # 合成清单须覆盖才拦得住回归）。round-11
+                         # 真机修复（层 1）后叶子模块还含 errors.py
+                         # 与 stub __init__.py。
                          "systemd-container", "chv-cell", "chv-broker",
                          "chv-browser", "chv-authd",
                          "git-credential-chv-authd", "chv-authd.service",
                          "cloud/chv/authd.py", "cloud/chv/sentinel.py",
+                         "cloud/chv/errors.py", "cloud/chv/__init__.py",
                          "vsock_notify",
                          "playwright", "chromium-headless-shell"],
             "versions": {"dpkg": dpkg,