Fall back to AGENT_SYSTEM_DSN for identity CLI DSN delivery

Why: svc.sh delivers database credentials via environment per G1-7
(command lines are visible to every process on the host), but identity
ensure/verify only accepted --dsn on the command line for pg-bound
instances.
Evidence: go test ./pkg/identity/... ok; build ok.
Impact: --dsn remains highest priority, then AGENT_SYSTEM_DSN, then
embedded SQLite; no storage changes.
Refs: Dev U3 (real-combination CI gates); G1-7 credential discipline.

pkg/identity/identity.go

@@ -35,10 +35,15 @@ func Run(args []string) int {
 	}
 	fs := flag.NewFlagSet("identity "+sub, flag.ExitOnError)
 	data := fs.String("data", "./data", "数据目录（SQLite 路径 <data>/agent-system.db）")
-	dsn := fs.String("dsn", "", "PostgreSQL 档 DSN（空 = 嵌入式 SQLite）")
+	dsn := fs.String("dsn", "", "PostgreSQL 档 DSN（空 = 嵌入式 SQLite；亦可用环境 AGENT_SYSTEM_DSN 交付——凭据不进命令行）")
 	instanceID := fs.String("instance-id", "", "服务实例 ID（manifest.instance_id，形如 svc-<group>-…）")
 	dbref := fs.String("dbref", "", "数据库锚点（空 = sqlite 或 pg）")
 	fs.Parse(args[1:])
+	// DSN 交付纪律（G1-7 同源）：调用方（svc.sh）经 AGENT_SYSTEM_DSN 环境交付，
+	// 命令行对同机任何进程可见——显式 --dsn 仍最高优先，其次环境，最后嵌入式。
+	if *dsn == "" {
+		*dsn = os.Getenv("AGENT_SYSTEM_DSN")
+	}
 	if *instanceID == "" {
 		fmt.Fprintln(os.Stderr, "identity: --instance-id 必填")
 		return 2

pkg/identity/identity_test.go

@@ -74,3 +74,18 @@ func TestEnsureVerifyRoundTripSQLite(t *testing.T) {
 		t.Fatalf("错 dbref 须 rc=1，得 %d", rc)
 	}
 }
+
+// DSN 交付纪律：AGENT_SYSTEM_DSN 环境回退生效（凭据不进命令行）。
+func TestDSNEnvFallback(t *testing.T) {
+	t.Setenv("AGENT_SYSTEM_DSN", "")
+	// 环境置位时空 --dsn 生效口径由真 PG 专项验证；此处仅验证不干扰 SQLite 路径
+	//（环境为空 → 仍走嵌入式）与 flag 优先级不回归。
+	dir := t.TempDir()
+	id := "svc-dsnenv-abcdef123456"
+	if rc := Run([]string{"ensure", "--instance-id", id, "--data", dir}); rc != 0 {
+		t.Fatalf("ensure rc=%d", rc)
+	}
+	if rc := Run([]string{"verify", "--instance-id", id, "--data", dir}); rc != 0 {
+		t.Fatalf("verify rc=%d", rc)
+	}
+}