round-12: merge round-11 head 717efc4 (V-9 real-machine fixes)

Round-11 moved on Gitea after round-12 branched (29d3a5a -> 717efc4):
V-9 guest-env fixes must be in any image built from this branch, or
the round-12 image would ship the known defects V-9 found (guest-env
never created when owner=chv:chv; wake reporting ready ~30s before
the runcmd chown lands). Contents, all from 717efc4:
- build.sh: runcmd chowns /etc/chv/guest-env to chv:chv after
  'start chv-authd', before 'chv-sync boot'
- check/generate_lockfile.py: DECLARED_SOURCES gains P2 trio
  (chv-cell/broker/browser -> repo_commit)
- executor._wait_guest_env_usable: with secrets delivered, wait for
  guest-env readable by the SSH user before reporting ready; timeout
  stops the VM and raises guest_env_not_ready; called from _boot_vm
- hostkeys.py: V-9 root-cause comment (owner always root:root)
- test_chv_gitea_sync.py: 5 new tests

Conflict: build.sh runcmd line only. Resolved as union: 717efc4's
runcmd line (with chown) kept; HEAD's P4 trio + P7 chv-memory
copy-in lines (absent on the 717efc4 side) kept. executor.py
merged cleanly.

cloud/chv/executor.py

@@ -1415,6 +1415,43 @@ class CloudHypervisorExecutor(Executor):
             "guest SSH 就绪超时：%d 次轮询内 sshd 未通，已关 VM"
             % attempts)
 
+    def _wait_guest_env_usable(self, task: dict) -> None:
+        """密钥已投递时，等客内 guest-env 对 SSH 用户可读再返回：
+        write_files 以 root:root 写文件（见 hostkeys.py——
+        write_files 在 users-groups 之前跑，owner 只能写 root），
+        客内 final 阶段的 99-chv-sync.cfg runcmd 才 chown 给
+        SSH 用户；SSH 就绪（vm_ready）比 final 阶段早约 30 秒
+        （V-9 真机：runcmd 脚本在 vm_ready 后约 31 秒才执行），
+        派发若在这窗口内 source 文件会 Permission denied。
+        判定用 `test -r`（SSH 用户本人可读与否，正是派发
+        source 的前置条件），不比对 owner 名。无密钥投递时
+        不等待、不轮询。超时先关 VM 再抛 guest_env_not_ready，
+        绝不带着读不到的密钥去跑任务。移植自 V-9（9fb0f4b）。"""
+        if not self._delivered_secrets(self.vm_name(task)):
+            return
+        from cloud.chv.hostkeys import GUEST_ENV_PATH
+        attempts = max(1, int(self.ready_timeout / self.ready_interval))
+        for attempt in range(attempts):
+            try:
+                result = self._call_runner(self.build_ssh_command(
+                    task, ["test", "-r", GUEST_ENV_PATH]))
+            except Exception:
+                result = None
+            if (result is not None
+                    and getattr(result, "returncode", 1) == 0):
+                return
+            if attempt + 1 < attempts:
+                self.sleeper(self.ready_interval)
+        try:
+            self.stop_vm(task)
+        except Exception:
+            pass
+        raise ChvFailure(
+            "guest_env_not_ready",
+            "guest-env 在 %d 次轮询内仍对 SSH 用户不可读，已关 VM："
+            "runcmd chown 未生效或 cloud-init 未完成"
+            % attempts)
+
     def _guest_host_command(self, *args, model=None, effort=None,
                             approval=None, sandbox=None,
                             model_provider=None):
@@ -1820,7 +1857,9 @@ class CloudHypervisorExecutor(Executor):
 
     def _boot_vm(self, task, name, task_disk, seed_disk,
                  net_entries) -> None:
-        """VMM 启动→vm.create→vm.boot→SSH 就绪，纯移动。"""
+        """VMM 启动→vm.create→vm.boot→SSH 就绪→密钥已投递时
+        等 guest-env 对 SSH 用户可读（V-9 移植，见
+        _wait_guest_env_usable），纯移动。"""
         socket_path = self.api_socket(task)
         self._launch_api_only(task)
         self.wait_api_ready(task)
@@ -1849,6 +1888,9 @@ class CloudHypervisorExecutor(Executor):
                 "vm.boot 失败：status=%s" % status)
         self._emit("vm_boot", task, "vm=%s" % name)
         self.wait_guest_ready(task)
+        # V-9 移植：密钥已投递时等 guest-env 对 SSH 用户可读再报
+        # 就绪（runcmd chown 比 SSH 就绪晚约 30 秒）。
+        self._wait_guest_env_usable(task)
 
     def _wake_prepare(self, task: dict, name: str) -> tuple:
         """wake 准备：reuse 审计、旧 VM 清理、任务盘供给、
@@ -1878,7 +1920,8 @@ class CloudHypervisorExecutor(Executor):
         preflight → 容量门 → 磁盘配额门 → 每任务磁盘供给 →
         launcher 只起 VMM（--api-socket）→ 等 vmm.ping 通 →
         PUT vm.create（VmConfig）→ PUT vm.boot → 等 guest
-        SSH 就绪。任一步失败都关 VM（stop_vm）再抛
+        SSH 就绪 → 密钥已投递时再等 guest-env 对 SSH 用户可读
+        （见 _wait_guest_env_usable，V-9 移植）。任一步失败都关 VM（stop_vm）再抛
         ChvFailure，绝不带着半醒的 VM 去跑任务。
         成功返回 {vm, api_socket, state: "running", ready: True,
         mode: "cold"}，并审计 vm_create/vm_boot/vm_ready。

cloud/chv/hostkeys.py

@@ -213,7 +213,13 @@ def _guest_env_entry(merged_env: dict) -> list:
     """guest-env 的 write_files 条目行（0600 root，值经
     shlex.quote 引用）：只能并进已有的 write_files 列表，
     绝不能再写一个 write_files: 键（YAML 重复键会覆盖掉
-    host key 的两条写文件条目，预置即失效）。"""
+    host key 的两条写文件条目，预置即失效）。
+    owner 恒为 root:root（V-9 真机根因：cloud-init 的 config
+    阶段里 write_files 在 users-groups 之前跑，owner 写
+    chv:chv 时 getpwnam('chv') 尚不存在，整个 write_files
+    模块失败、guest-env 文件根本不产生）。文件改归 SSH 用户
+    由客内 final 阶段 99-chv-sync.cfg runcmd 在 chv-sync
+    boot 之前 chown（用户那时已建好），见 chv-guest/build.sh。"""
     lines = [
         "  - path: %s" % GUEST_ENV_PATH,
         "    permissions: '0600'",