fix(chv): 79-chv-cell.network 改回 root:root 644（构建 #5 驱动实证）

virt-customize --copy-in 保留构建宿主 uid/mode，79 文件在客机
落盘成 chv:chv 640，networkd 不认它、改配 80-container-ve.network、
刷掉 10.200.0.1，cell _iface_has_ip 复核失败、codex --help rc=1。
构建时显式 chown root:root + chmod 644 并断言属主与权限；
回归测试 BuildWiringTest.test_build_sh_fixes_cell_network_file_owner。

chv-guest/build.sh

@@ -307,7 +307,13 @@ VC_ARGS=(-a "$OUT/disk.raw"
   --copy-in "$SCRIPT_DIR/chv-syncd.py:/usr/local/bin/"
   --run-command 'mv /usr/local/bin/chv-daemon.py /usr/local/bin/chv-daemon && mv /usr/local/bin/chv-execd.py /usr/local/bin/chv-execd && mv /usr/local/bin/chv-syncd.py /usr/local/bin/chv-syncd && chmod +x /usr/local/bin/chv-daemon /usr/local/bin/chv-execd /usr/local/bin/chv-syncd'
   --copy-in "$SCRIPT_DIR/79-chv-cell.network:/etc/systemd/network/"
-  --run-command 'test -f /etc/systemd/network/79-chv-cell.network && grep -q "^Unmanaged=yes" /etc/systemd/network/79-chv-cell.network && grep -q "^Name=ve-chv-cell" /etc/systemd/network/79-chv-cell.network'
+  # 构建 #5 教训（2026-11-08 驱动实证）：virt-customize --copy-in
+  # 会原样保留构建宿主文件的 uid/mode——宿主 wecoo uid 1000 在客
+  # 机就是 chv，79 文件落盘成 -rw-r----- chv:chv；networkd 不认
+  # 它（改配 80-container-ve.network、刷掉 10.200.0.1，cell 的
+  # _iface_has_ip 复核失败、codex --help rc=1）。此处显式改回
+  # root:root 644 并断言属主与权限，不再只验内容。
+  --run-command 'chown root:root /etc/systemd/network/79-chv-cell.network && chmod 644 /etc/systemd/network/79-chv-cell.network && test -f /etc/systemd/network/79-chv-cell.network && grep -q "^Unmanaged=yes" /etc/systemd/network/79-chv-cell.network && grep -q "^Name=ve-chv-cell" /etc/systemd/network/79-chv-cell.network && [ "$(stat -c %U /etc/systemd/network/79-chv-cell.network)" = "root" ] && [ "$(stat -c %a /etc/systemd/network/79-chv-cell.network)" = "644" ]'
   --run-command 'printf "runcmd:\n - systemctl restart ssh || service ssh restart || true\n - test -f /etc/chv/guest-env && chown chv:chv /etc/chv/guest-env || true\n - /usr/local/bin/chv-data-mount >>/var/log/chv-data-mount.log 2>&1 || true\n - /usr/local/bin/chv-sync boot >>/var/log/chv-sync.log 2>&1 || true\n" > /etc/cloud/cloud.cfg.d/99-chv-sync.cfg'
   --run-command 'git config --system user.name chv && git config --system user.email chv@localhost && git config --system credential.helper store && git config --system init.defaultBranch main'
   --run-command "$GT_INSTALL_CMD"

cloud/tests/test_chv_opt_stage2.py

@@ -431,6 +431,26 @@ class BuildWiringTest(unittest.TestCase):
         self.assertLess(cfg_line.index("chv-data-mount >>"),
                         cfg_line.index("chv-sync boot"))
 
+    def test_build_sh_fixes_cell_network_file_owner(self):
+        # 构建 #5 教训：virt-customize --copy-in 保留宿主 uid/mode，
+        # 79 文件在客机落盘成 chv:chv 640，networkd 不认它、改配
+        # 80-container-ve.network、刷掉 10.200.0.1，cell 复核失败。
+        # build.sh 须显式改回 root:root 644 并断言属主与权限。
+        with open(_repo("chv-guest", "build.sh")) as fh:
+            text = fh.read()
+        self.assertIn(
+            "chown root:root /etc/systemd/network/79-chv-cell.network",
+            text)
+        self.assertIn(
+            "chmod 644 /etc/systemd/network/79-chv-cell.network",
+            text)
+        self.assertIn(
+            'stat -c %U /etc/systemd/network/79-chv-cell.network',
+            text)
+        self.assertIn(
+            'stat -c %a /etc/systemd/network/79-chv-cell.network',
+            text)
+
     def test_lockfile_and_buildinfo_declare_services(self):
         spec = importlib.util.spec_from_file_location(
             "stage2_buildinfo",