Hard-disable exec tools for every call in the full-track test

Why: only the deploy invocation carried RDM_DISABLE_EXEC_TOOLS; the
trailing restart ran without it and the serve died on keyless runners
under the bwrap fail-closed policy (run 3765).
Evidence: local suite green; the restart now inherits the hard-disable.
Impact: tests only.

tests/test_svc_realcombo.py

@@ -174,8 +174,10 @@ class RealComboTests(tsr.SvcAutoRecoverTests):
     def test_U3_real_rdm_full_deploy_track(self):
         """全轨：materialize（真实 make build）→ 候选身份门禁 → release 切换 →
         伴生工作台 200 → 裸重启稳定。"""
+        # 硬关须覆盖本测试全部调用（deploy/start/restart/stop 的 serve 都要），
+        # 不只 deploy 一处——CI 无 bwrap 时 fail-closed 拒启。
+        self.env["RDM_DISABLE_EXEC_TOOLS"] = "1"
         env = dict(self.env)
-        env["RDM_DISABLE_EXEC_TOOLS"] = "1"
         env.update(ci_git_env())
         env.update({"SVC_RDM_SRC_DIR": str(self.root / "rdmcache"),
                     "SVC_RDM_ORIGIN": RDM_ORIGIN})