feat(chv-guest): 轻量镜像 + Gitea 双向同步（停全量版，改 Ubuntu Minimal）

- build.sh 改轻量：Ubuntu Minimal 底座、apt 精简（git/ssh/cloud-init/
  python3/pip/curl/ca-certificates/xz-utils/fonts-wqy-microhei）、
  Playwright + chromium-headless-shell、去 B-16 +12G 扩盘；
  加 git + gt 1.0.0（官方 install.sh + SHA256 校验，GITEA_CLI_VERSION
  钉 1.0.0）与 chv-sync 启动钩子（cloud-init runcmd）
- B-19（新发现）：dpkg freeze 的 ${Package} 会被客机 shell 展开
  成空，284 行全空白；加反斜杠转义，探针实测已出真实版本
- buildinfo.py：轻量 contents、chromium-headless-shell、gt_version
- generate/check_lockfile.py：gt/chv-sync 声明来源、headless-shell 映射
- chv-sync.sh（新）：boot/pull/push/status，分叉/脏树失败关闭，
  凭证走 seed 盘 guest-env，不进镜像
- README §1/§2/§3/§4 改轻量口径，新增 §7 Gitea 双向同步
- tests：ChvSyncTest 6 项（本地 bare 仓当远端）；针对性测试 144 项全过

chv-guest/buildinfo.py

@@ -15,16 +15,20 @@ sha256/size 是对产物文件实测的；image_sha256 即 disk.raw
 import hashlib
 import json
 import os
+import re
 import sys
 import time
 
+# 轻量口径（2026-11-06 用户定）：Ubuntu Minimal 底座，只装
+# codex + Python + SSH + cloud-init + 薄 agent + git + gt +
+# 最小中文字体；已裁剪 pandoc/texlive/python-docx 等文档工具
+# 与 qemu-guest-agent。chv-sync 是仓库内脚本，版本随 repo_commit。
 BASE_CONTENTS = [
-    "git", "pandoc", "poppler-utils", "latexmk",
-    "texlive-latex-base", "openssh-server", "cloud-init",
-    "qemu-guest-agent", "python-docx", "openpyxl",
-    "python-pptx", "PyMuPDF", "Pillow", "codex",
+    "git", "openssh-server", "cloud-init",
+    "python3", "python3-pip", "curl", "ca-certificates",
+    "xz-utils", "fonts-wqy-microhei", "codex",
     "codex-code-mode-host", "codex-resources/bwrap",
-    "/app/host.py",
+    "/app/host.py", "gt", "chv-sync",
 ]
 
 # 执行器默认内核 cmdline（config.py），构建产物须与它一起记录（B-12），
@@ -62,9 +66,17 @@ def build(outdir, tag, ubuntu, codex_version, repo_commit,
             os.path.join(outdir, "guest-versions-dpkg.txt")),
         "pip": _read_lines(
             os.path.join(outdir, "guest-versions-pip.txt")),
+        "gt": _read_lines(
+            os.path.join(outdir, "guest-versions-gt.txt")),
     }
+    gt_version = ""
+    for line in versions["gt"]:
+        m = re.search(r"(\d+\.\d+\.\d+)", line)
+        if m:
+            gt_version = m.group(1)
+            break
     if playwright:
-        contents += ["playwright", "chromium"]
+        contents += ["playwright", "chromium-headless-shell"]
         versions["chromium"] = _read_lines(
             os.path.join(outdir, "guest-versions-chromium.txt"))
     info = {
@@ -72,6 +84,7 @@ def build(outdir, tag, ubuntu, codex_version, repo_commit,
         "ubuntu": ubuntu,
         "codex_version": codex_version,
         "repo_commit": repo_commit,
+        "gt_version": gt_version,
         "built_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
         "contents": contents,
         "versions": versions,
@@ -108,6 +121,9 @@ def main(argv):
     if not info["versions"]["pip"]:
         print("BUILDINFO versions.pip 为空", file=sys.stderr)
         return 1
+    if not info["gt_version"]:
+        print("BUILDINFO gt_version 为空（gt 未装好）", file=sys.stderr)
+        return 1
     if info["tag"] != tag:
         print("BUILDINFO tag 不一致", file=sys.stderr)
         return 1