fix(chv-muse-r11fix): cell 只遮 /usr 下路径（复测新发现 1）

--volatile=yes 下容器根是基本空的 tmpfs（只挂进只读 /usr），
nspawn 按容器根解析 --inaccessible 路径，/etc/chv 与
/home/chv/.git-credentials 在容器根里根本不存在，解析失败即
Failed to resolve 而起不来；两条 /usr 旗可解析，保留。
凭证文件按构造即不可达（容器根里无 /home、无 /etc/chv），
遮蔽不再是必须项，安全属性不变。
探针证据：celldiag2/3/4——去 inaccessible 后完整 argv 0.4s/rc=0，
单元内 $HOME/.cache 可写，单元内 ls /etc/chv 本来就不存在。

cloud/tests/test_chv_muse_p2.py

@@ -78,10 +78,17 @@ class CellArgvTest(unittest.TestCase):
             playwright_package_dir="/usr/local/lib/python3.12/dist-packages/playwright")
         hidden = [a.split("=", 1)[1] for a in argv
                   if a.startswith("--inaccessible=")]
-        for path in ("/etc/chv", "/home/chv/.git-credentials",
-                     "/usr/local/share/ms-playwright",
+        # /usr 下的浏览器路径仍遮蔽（/usr 只读挂进单元，遮蔽有效）。
+        for path in ("/usr/local/share/ms-playwright",
                      "/usr/local/lib/python3.12/dist-packages/playwright"):
             self.assertIn(path, hidden)
+        # round-11 复测纠正（第二轮）：/etc/chv 与
+        # /home/chv/.git-credentials 不再列出——--volatile=yes 下
+        # 容器根是基本空的 tmpfs，这两处在容器根里根本不存在，
+        # 凭证文件按构造即不可达；列出反而让 nspawn 解析失败
+        #（Failed to resolve）而起不来。
+        for path in ("/etc/chv", "/home/chv/.git-credentials"):
+            self.assertNotIn(path, hidden)
 
     def test_writable_binds_and_tmpfs(self):
         argv = CELL.build_nspawn_argv(["true"])
@@ -348,26 +355,27 @@ class BrowserTest(unittest.TestCase):
             ok, _ = BROWSER.validate_url(bad)
             self.assertFalse(ok, bad)
 
-    def test_truncate_a11y_small_tree_untouched(self):
-        tree = {"role": "WebArea", "name": "Example",
-                "children": [{"role": "heading", "name": "Hi"}]}
-        out, truncated = BROWSER.truncate_a11y(tree)
+    def test_truncate_aria_small_snapshot_untouched(self):
+        text = ("- generic [ref=e1]:\n"
+                "  - heading \"Example Domain\" [level=1] [ref=e2]")
+        out, truncated = BROWSER.truncate_aria(text)
         self.assertFalse(truncated)
-        self.assertEqual(out, tree)
+        self.assertEqual(out, text)
 
-    def test_truncate_a11y_node_cap(self):
-        tree = {"role": "WebArea",
-                "children": [{"role": "link", "name": "l%d" % i}
-                             for i in range(300)]}
-        out, truncated = BROWSER.truncate_a11y(tree)
+    def test_truncate_aria_node_cap(self):
+        text = "\n".join("- link \"l%d\" [ref=e%d]" % (i, i)
+                         for i in range(300))
+        out, truncated = BROWSER.truncate_aria(text)
         self.assertTrue(truncated)
-        self.assertLessEqual(len(out["children"]), 200)
+        nodes = [ln for ln in out.splitlines()
+                 if ln.lstrip().startswith("- ")]
+        self.assertLessEqual(len(nodes), 200)
 
-    def test_truncate_a11y_char_cap(self):
-        tree = {"role": "WebArea", "name": "x" * 70000, "children": []}
-        out, truncated = BROWSER.truncate_a11y(tree)
+    def test_truncate_aria_char_cap(self):
+        text = "- paragraph \"" + "x" * 70000 + "\" [ref=e1]"
+        out, truncated = BROWSER.truncate_aria(text)
         self.assertTrue(truncated)
-        self.assertTrue(out.get("truncated_chars"))
+        self.assertLessEqual(len(out), BROWSER.MAX_A11Y_CHARS)
 
     def test_forbidden_ops_never_execute(self):
         agent = mock.Mock()
@@ -405,7 +413,11 @@ class BrowserTest(unittest.TestCase):
             self.assertTrue(resp["ok"])
             self.assertEqual(resp["title"], "Example Domain")
             self.assertEqual(resp["url"], "https://example.com/")
-            self.assertEqual(resp["a11y"]["role"], "WebArea")
+            # round-11 复测纠正（第二轮）：a11y 是 ARIA 快照字符串
+            #（Playwright Page.aria_snapshot()），不是 dict 树。
+            self.assertIsInstance(resp["a11y"], str)
+            self.assertIn("Example Domain", resp["a11y"])
+            self.assertFalse(resp["truncated"])
             snap = agent.snapshot()
             self.assertTrue(snap["ok"])
             shot = agent.screenshot()
@@ -488,13 +500,13 @@ class FakePage:
     def title(self):
         return "Example Domain"
 
-    @property
-    def accessibility(self):
-        return self
-
-    def snapshot(self):
-        return {"role": "WebArea", "name": "Example Domain",
-                "children": [{"role": "heading", "name": "Example"}]}
+    # 真实 Playwright 1.64.1 的快照入口是 Page.aria_snapshot()
+    #（返回字符串）；旧 fake 的 accessibility.snapshot() 是
+    # Puppeteer 的形状，真实库里不存在，round-11 第二轮复测
+    # 已证实会报 'Page' object has no attribute 'accessibility'。
+    def aria_snapshot(self):
+        return ("- generic [ref=e1]:\n"
+                "  - heading \"Example Domain\" [level=1] [ref=e2]")
 
     def screenshot(self, path=None):
         with open(path, "wb") as fh: