round-12: merge round-11 head 717efc4 (V-9 real-machine fixes)

Round-11 moved on Gitea after round-12 branched (29d3a5a -> 717efc4):
V-9 guest-env fixes must be in any image built from this branch, or
the round-12 image would ship the known defects V-9 found (guest-env
never created when owner=chv:chv; wake reporting ready ~30s before
the runcmd chown lands). Contents, all from 717efc4:
- build.sh: runcmd chowns /etc/chv/guest-env to chv:chv after
  'start chv-authd', before 'chv-sync boot'
- check/generate_lockfile.py: DECLARED_SOURCES gains P2 trio
  (chv-cell/broker/browser -> repo_commit)
- executor._wait_guest_env_usable: with secrets delivered, wait for
  guest-env readable by the SSH user before reporting ready; timeout
  stops the VM and raises guest_env_not_ready; called from _boot_vm
- hostkeys.py: V-9 root-cause comment (owner always root:root)
- test_chv_gitea_sync.py: 5 new tests

Conflict: build.sh runcmd line only. Resolved as union: 717efc4's
runcmd line (with chown) kept; HEAD's P4 trio + P7 chv-memory
copy-in lines (absent on the 717efc4 side) kept. executor.py
merged cleanly.

chv-guest/build.sh

@@ -316,7 +316,7 @@ VC_ARGS=(-a "$OUT/disk.raw"
   --copy-in "$SCRIPT_DIR/chv-authd.service:/etc/systemd/system/"
   --run-command 'mv /usr/local/bin/authd.py /usr/local/bin/chv-authd && chmod +x /usr/local/bin/chv-authd /usr/local/bin/git-credential-chv-authd'
   --run-command 'systemctl enable chv-authd || true'
-  --run-command 'printf "runcmd:\n - systemctl restart ssh || service ssh restart || true\n - systemctl start chv-authd || true\n - /usr/local/bin/chv-sync boot >>/var/log/chv-sync.log 2>&1 || true\n" > /etc/cloud/cloud.cfg.d/99-chv-sync.cfg'
+  --run-command 'printf "runcmd:\n - systemctl restart ssh || service ssh restart || true\n - systemctl start chv-authd || true\n - test -f /etc/chv/guest-env && chown chv:chv /etc/chv/guest-env || true\n - /usr/local/bin/chv-sync boot >>/var/log/chv-sync.log 2>&1 || true\n" > /etc/cloud/cloud.cfg.d/99-chv-sync.cfg'
   --copy-in "$SCRIPT_DIR/chv-cdp-broker.py:/usr/local/bin/"
   --copy-in "$SCRIPT_DIR/chv_browser_guard.py:/usr/local/bin/"
   --copy-in "$SCRIPT_DIR/browser-blocklist.txt:/usr/local/share/chv/"

chv-guest/check_lockfile.py

@@ -25,6 +25,11 @@ DECLARED_SOURCES = {
     "/app/host.py": "repo_commit",
     "gt": "gt_version",
     "chv-sync": "repo_commit",
+    # 对齐 Muse P2：nspawn 单元启动器 + broker + 浏览器子代理，
+    # 均是仓库内脚本，版本随 repo_commit（与 chv-sync 同款）。
+    "chv-cell": "repo_commit",
+    "chv-broker": "repo_commit",
+    "chv-browser": "repo_commit",
 }
 
 

chv-guest/generate_lockfile.py

@@ -46,6 +46,11 @@ DECLARED_SOURCES = {
     "/app/host.py": "repo_commit",
     "gt": "gt_version",
     "chv-sync": "repo_commit",
+    # 对齐 Muse P2：nspawn 单元启动器 + broker + 浏览器子代理，
+    # 均是仓库内脚本，版本随 repo_commit（与 chv-sync 同款）。
+    "chv-cell": "repo_commit",
+    "chv-broker": "repo_commit",
+    "chv-browser": "repo_commit",
 }