feat: CHV 审核修复 P2（范围恢复为全做）

P2-1：preflight reuse/CPU/内存校验块小提取为
_preflight_config_checks（纯移动，深耦合处如实停）。
P2-2：build_vm_command 降级为私有 _build_vm_command；
Docker goal 内联解析顶部加正典分叉说明 + 同步检查清单。
P2-3：gaps grep 文本断言改成真实 Worker._run_attempt
行为断言。P2-4：README/build.sh 口径对齐（章节顺序、
BUILDINFO 名字列表、Node.js 不装写实）。P2-5：stop_vm
删除失败记审计。P2-6：CPU/内存校验统一进 preflight。
测试：原 84 + 新增 33 = 117 项，mock，无真 VM。

cloud/tests/test_chv_fix.py

@@ -15,6 +15,7 @@ import sys
 import tempfile
 import threading
 import unittest
+from unittest import mock
 from pathlib import Path
 from types import SimpleNamespace
 
@@ -550,5 +551,44 @@ class ExecuteDeadPortTest(ChvFixCase):
         self.assertEqual(ctx.exception.kind, "vm_not_running")
 
 
+# -- P2 配置校验时机 / 文档口径 ------------------------------------------
+class ConfigTimingAndDocsTest(ChvFixCase):
+    def test_preflight_rejects_bad_cpu_and_memory(self):
+        ex = self.make_exec(cpus="abc")
+        with self.assertRaises(ChvFailure) as ctx:
+            ex.preflight()
+        self.assertEqual(ctx.exception.kind, "config_invalid")
+        ex2 = self.make_exec(memory="not-a-size")
+        with self.assertRaises(ChvFailure) as ctx2:
+            ex2.preflight()
+        self.assertEqual(ctx2.exception.kind, "config_invalid")
+
+    def test_stop_cleanup_failure_is_audited(self):
+        ex = self.make_exec()
+        ex.stop_vm({"id": "ck"})
+        os.makedirs(os.path.join(self.state_dir, "chv-ck", "seed"),
+                    exist_ok=True)
+        with mock.patch("cloud.chv.executor.shutil.rmtree",
+                        side_effect=OSError("rm failed")):
+            ex.stop_vm({"id": "ck"})
+        self.assertTrue(any(e == "vm_key_cleanup_failed"
+                            for e, _, _, _ in self.audit))
+
+    def test_readme_sections_in_order_and_buildinfo_honest(self):
+        readme = Path(__file__).resolve().parents[2] \
+            / "chv-guest" / "README.md"
+        text = readme.read_text()
+        self.assertLess(text.index("## 5. Host key"),
+                        text.index("## 6. 与执行器的对接"))
+        self.assertIn("contents: [清单逐项名]", text)
+        self.assertIn("Node.js 不装", text)
+
+    def test_manual_vm_command_is_private(self):
+        ex = self.make_exec()
+        self.assertFalse(hasattr(ex, "build_vm_command"))
+        cmd = ex._build_vm_command({"id": "t"})
+        self.assertIn("--api-socket", cmd)
+
+
 if __name__ == "__main__":
     unittest.main()