<fix>[ctl]: heal zstack-ctl build deps

[zstack-robot-2]

Run a minimal build dependency check before zstack-ctl recreates its
Python 3.11 virtualenv. The check installs missing Python 3.11, gcc,
libffi, and OpenSSL build packages from zstack-local, restores Red Hat
spec or plugin packages when Python CFLAGS requires them, and verifies a
tiny Python C extension can compile before pip builds zstackctl
dependencies.

This lets a rerun of the upgrade command recover hosts where Python C
extension build files were lost during an interrupted upgrade.

JIRA: ZSTAC-74634
Change-Id: I1805307cff2ba922ccf8c55e5c23daaefec78000

sync from gitlab !10038

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: http://open.zstack.ai:20001/code-reviews/zstack-cloud.yaml (via .coderabbit.yaml)

Review profile: CHILL

Plan: Pro

Run ID: d41ae23c-6ba8-45de-ae2f-11c84bdf2669

📥 Commits

Reviewing files that changed from the base of the PR and between 113a77a and 7cdc10f.

📒 Files selected for processing (1)

• conf/tools/install.sh

---

总览

脚本在 zstack-ctl 安装前添加了构建依赖预检查逻辑，包括RPM包验证、Python编译标志检查和C扩展编译验证，以确保构建环境完整可用。

变更内容

构建依赖预检查

层级 / 文件	摘要
构建依赖验证函数库 conf/tools/install.sh	新增9个函数：zstack_local_repo_args() 检测本地yum源、yum_install_packages() 和 yum_reinstall_packages() 封装包管理、ensure_rpm_packages_installed() 和 verify_rpm_packages() 检查缺失和损坏的RPM包、python_cflags_need_annobin() 和 python_cflags_need_redhat_rpm_config() 根据Python CFLAGS判断编译工具链需求、verify_python_c_extension_build() 通过编译最小C扩展验证完整编译环境。
主流程依赖预检集成 conf/tools/install.sh	在zstack-ctl工具分支中新增调用 ensure_zstack_ctl_build_deps，失败则直接 exit 1 中断后续安装步骤。

评估指标

🎯 3 (中等) | ⏱️ ~20 分钟

庆祝诗

🐰 构建链检查添新功，
依赖验证护周全，
C扩展编译试一试，
环境完备再安装！

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 9.09% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	标题遵循了要求的 [scope]: 格式，长度为38字符，未超过72字符限制，并准确总结了拉取请求的主要变更内容。
Description check	✅ Passed	描述与变更集合的内容相关，详细说明了构建依赖检查的目的和功能，包括安装缺失包、恢复Red Hat特定包和验证C扩展编译能力。
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/dejing.liu/codex/ZSTAC-74634-zstackctl-build-deps-5.5.22

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[MatheMatrix]

Comment from 刘德靖:

Additional validation on 5.5.22 Python3 environment:

• Environment: ZStack-Cloud 5.5.22.373 on 172.24.247.245
• zstack-ctl venv Python: Python 3.11.11
• Test: removed annobin with rpm -e --nodeps annobin, then ran the MR version of install.sh zstack-ctl
• Result: zstack-ctl installation succeeded and zstack-ctl status returned success
• Observation: Python3.11 CFLAGS in this build do not reference redhat-annobin-cc1, so annobin is not required on this path. The MR logic is therefore kept conditional: install/reinstall annobin only when the active Python CFLAGS actually require it.
• Environment was restored after validation: annobin rpm and annobin.so are present again, MN/UI remain Running.

No code update was needed after this validation.