Clear must_change for load users and harden cleanup

Why: backend U4 password gate returns 403 on business APIs until must_change clears; CLI-created load passwords are terminal.
Evidence: dual smoke failed POST /api/projects 403 after login_keys pin.
Impact: load suite works on schema v26+; EXIT trap disables re-entry and waits for serve.
Refs: server enforcePasswordGate; CreateAccount must_change
Co-authored-by: Cursor <cursoragent@cursor.com>

tests/load/collaboration/run_load.sh

@@ -59,11 +59,13 @@ OWNED_PG=0
 APP_PID=""
 APP_PID_B=""
 ARTS_DIR=""
-EXIT_CODE=0
 cleanup() {
-  EXIT_CODE=$?
-  [[ -n "$APP_PID" ]] && kill "$APP_PID" 2>/dev/null || true
-  [[ -n "$APP_PID_B" ]] && kill "$APP_PID_B" 2>/dev/null || true
+  local ec=$?
+  trap - EXIT # 防止 exit 重入本 trap
+  [[ -n "${APP_PID:-}" ]] && kill "$APP_PID" 2>/dev/null || true
+  [[ -n "${APP_PID_B:-}" ]] && kill "$APP_PID_B" 2>/dev/null || true
+  wait "$APP_PID" 2>/dev/null || true
+  wait "$APP_PID_B" 2>/dev/null || true
   if [[ $OWNED_PG -eq 1 && $KEEP -eq 0 ]]; then
     "$ROOT/scripts/svc.sh" u7load stop >/dev/null 2>&1 || true
     "$ROOT/scripts/svc.sh" rm u7load --purge >/dev/null 2>&1 || true
@@ -75,8 +77,7 @@ cleanup() {
       echo "[load] --keep：栈保留（PG=u7load:$PG_PORT，app=127.0.0.1:$APP_PORT，结果 $RESULTS）"
     fi
   fi
-  # 保留主流程退出码（不可 return 0，否则失败被抹成成功）。
-  exit "$EXIT_CODE"
+  exit "$ec"
 }
 trap cleanup EXIT
 
@@ -133,6 +134,9 @@ if [[ "$SEED" != "none" ]]; then
   "$HERE/.build/seed" --dsn "$APP_DSN" --profile "$SEED" --manifest "$RESULTS/seed-manifest.json"
 fi
 
+# CLI 给定密码仍写 must_change=true（U4 设密门）；压测口令即终态，清标志以免探针/k6 403。
+psql "$APP_DSN" -v ON_ERROR_STOP=1 -c "UPDATE users SET must_change_password=FALSE" >/dev/null
+
 # ---- 4) 起被测实例（mock；执行原语关闭——压测不打执行面） ----
 ARTS_DIR="$RESULTS/artifacts"
 mkdir -p "$ARTS_DIR"