Give pin materialize the CI git channel and a private database

Why: test-pg has no SSH known_hosts, and the shared agent_test database already holds another instance identity.
Evidence: SELF python3 -m unittest tests.test_ci_credentials.CheckoutTests.test_rdm_pin_fetch_is_three_shas_on_the_allowlist tests.integration.lifecycle.test_lifecycle_real (1 pass, 24 skip).
Impact: lifecycle children forward GIT_CONFIG_* only; serve stays env -i. Login and rdm.ping stay NOT_RUN.
Refs: .task/feature-svc-d3-real-scenarios.md
Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/svc.sh

@@ -1435,8 +1435,9 @@ svc_launch_serve() {
 }
 
 # svc_lifecycle_child ACTION [extra args...]：用清空的环境拉起本脚本的
-# __lifecycle。白名单：PATH/HOME/USER/LOGNAME/LANG/LC_*/TZ/TMPDIR、代理、SVC_*。
-# 从不传入 AGENT_SYSTEM_*。
+# __lifecycle。白名单：PATH/HOME/USER/LOGNAME/LANG/LC_*/TZ/TMPDIR、代理、SVC_*、
+# GIT_CONFIG_*（运行器把 SSH pin 改写成受信 HTTPS，token 只在环境里）。
+# 从不传入 AGENT_SYSTEM_*。serve 仍是 env -i，不继承这些变量。
 svc_lifecycle_child() {
   local -a args=(env -i "PATH=${PATH:-/usr/bin:/bin}" "HOME=${HOME:-/tmp}"
     "USER=${USER:-}" "LOGNAME=${LOGNAME:-${USER:-}}" "LANG=${LANG:-C.UTF-8}"
@@ -1450,7 +1451,7 @@ svc_lifecycle_child() {
   while IFS= read -r k; do
     [ -n "$k" ] || continue
     args+=("$k=${!k}")
-  done < <(compgen -e | grep -E '^(SVC_|LC_)' || true)
+  done < <(compgen -e | grep -E '^(SVC_|LC_|GIT_CONFIG_)' || true)
   if [ -n "${RDM_DISABLE_EXEC_TOOLS:-}" ]; then
     args+=("RDM_DISABLE_EXEC_TOOLS=$RDM_DISABLE_EXEC_TOOLS")
   fi