ci / vet-and-test (pull_request) Successful in 43s
Why: runIdentity lived in cmd/agent-system package main, so downstream combination binaries (Agent-System-RDM) cannot reuse it and their unknown subcommands fall into the serve path; the 2026-10-12 rdm1/rdmcand batch update failures traced back to that capability gap. Evidence: go test ./pkg/identity/... ok; CGO_ENABLED=0 go build ok; behavioral probes (usage rc=2, capabilities v1, ensure/verify roundtrip) recorded in the PR. Impact: identity semantics unchanged for the base binary; adds identity capabilities (v1) and usage-on-unknown contract shared by all products; no storage changes. Refs: Dev PR #474 (svc.sh candidate gate); user root-cause report 2026-10-12 U1 (shared identity interface).