fix(chv): 生产级审核 P1-01～P1-10 修复（堆叠于 #270 之上）

cloud/tests/test_chv_closeup.py

@@ -889,25 +889,31 @@ class DefensiveBranchTest(CloseupCase):
         ex.runner = keyscan_runner
         self.assertFalse(ex.capture_host_key(self._task()))
 
-    def test_build_ssh_command_fallback_and_secret_not_delivered(self):
+    def test_build_ssh_command_undeclared_raises_and_secret_not_delivered(self):
+        # feat-chv-p1fix（P1-04）：删除回环回落——目标未声明
+        # 时构造即抛 ssh_target_undeclared，不再悄悄连回环。
         ex = self.make_exec(env_extra={"CHV_SSH_FORWARD": "0"})
-        cmd = ex.build_ssh_command(self._task(), ["true"])
-        self.assertIn("127.0.0.1", " ".join(cmd))
+        with self.assertRaises(ChvFailure) as ctx:
+            ex.build_ssh_command(self._task(), ["true"])
+        self.assertEqual(ctx.exception.kind, "ssh_target_undeclared")
         ex = self.make_exec()
         with self.assertRaises(ChvFailure) as ctx:
             ex.build_ssh_command(self._task(), ["true"],
                                  extra_env={"SUB2API_API_KEY": "v"})
         self.assertEqual(ctx.exception.kind, "secret_env_not_delivered")
 
-    def test_write_provisioned_known_hosts_fallback(self):
+    def test_write_provisioned_known_hosts_undeclared_raises(self):
+        # feat-chv-p1fix（P1-04 同款）：预置 known_hosts 解析
+        # 失败即抛，不再回落回环写钉死。
         ex = self.make_exec(env_extra={"CHV_SSH_FORWARD": "0",
                                        "CHV_HOST_KEY_MODE": "provisioned"})
         vm_dir = os.path.join(self.state_dir, "chv-abc123")
         os.makedirs(vm_dir, exist_ok=True)
         paths = {"known_hosts": os.path.join(vm_dir, "known_hosts")}
-        ex._write_provisioned_known_hosts(paths, "ssh-ed25519 AAAA")
-        with open(paths["known_hosts"]) as fh:
-            self.assertIn("127.0.0.1", fh.read())
+        with self.assertRaises(ChvFailure) as ctx:
+            ex._write_provisioned_known_hosts(paths, "ssh-ed25519 AAAA")
+        self.assertEqual(ctx.exception.kind, "ssh_target_undeclared")
+        self.assertFalse(os.path.exists(paths["known_hosts"]))
 
     def test_provision_host_key_dirty_refused(self):
         ex = self.make_exec()
@@ -1083,22 +1089,26 @@ class DefensiveBranchTest(CloseupCase):
         self.assertFalse(ex._vm_is_running("chv-bad"))
 
     def test_clean_one_vm_secrets_remove_failures(self):
+        # feat-chv-p1fix（P1-03）：返回 3 元组，删失败以
+        # failed=True 区分，不再静默 pass。
         ex = self.make_exec()
         vm_dir = os.path.join(self.state_dir, "chv-x")
         os.makedirs(os.path.join(vm_dir, "ssh_host_ed25519_key"),
                     exist_ok=True)
-        removed_priv, removed_seed = ex._clean_one_vm_secrets(
+        removed_priv, removed_seed, failed = ex._clean_one_vm_secrets(
             "chv-x", vm_dir)
         self.assertFalse(removed_priv)
+        self.assertTrue(failed)
         vm2 = os.path.join(self.state_dir, "chv-y")
         os.makedirs(os.path.join(vm2, "seed"), exist_ok=True)
         import shutil
         real_rmtree = shutil.rmtree
         with mock.patch("shutil.rmtree",
                         side_effect=OSError("rmtree boom")):
-            removed_priv, removed_seed = ex._clean_one_vm_secrets(
+            removed_priv, removed_seed, failed = ex._clean_one_vm_secrets(
                 "chv-y", vm2)
         self.assertFalse(removed_seed)
+        self.assertTrue(failed)
         self.assertTrue(real_rmtree is not None)
 
     def test_cleanup_stale_vms_subcall_failures_and_poll_branches(self):