Gate svc lifecycles on real Dev and RDM artifacts in CI

Why: stub suites proved the script logic but not real artifact
behavior (the 2026-10-12 incidents passed all stub tests); the report's
U3 requires real-combination gates, and realcombo dry-runs exposed two
real gaps: fresh deploys closed identity governance one lifecycle late,
and pg-bound identity calls put the DSN on the command line.
Evidence: make test exit 0; local realcombo dry-run 16 OK (rows in the
task card); CI adds svc-realcombo (SQLite, both real binaries, full RDM
track) and a real-PG identity step on test-pg with env-delivered DSN.
Impact: tests/test_svc_realcombo.py (SVC_TEST_REAL gate, explicit
NOT_RUN otherwise); ci.yaml new job + test-pg step (RDM clone via
trusted-base URL-scoped token header, allowlist addition reviewed in
this PR); svc.sh delivers identity DSN via AGENT_SYSTEM_DSN and runs
manifest adoption in the same deploy that first registers svc.env;
modules/backend pinned to main (env fallback, backend #182).
Refs: .task/feature-svc-u3-realcombo.md; user goal directive 2026-10-12
(U3); backend #182; RDM #285.

scripts/svc.sh

@@ -1143,11 +1143,14 @@ svc_db_identity_ensure() {
   line="$(svc_db_identity_args)" || return 1
   IFS=$'\t' read -r iid dbref data <<<"$line"
   local args=(identity ensure --instance-id "$iid" --dbref "$dbref" --data "$data")
+  # G1-7（U3）：pg 档 DSN 经 AGENT_SYSTEM_DSN 环境交付，不进命令行——命令行对
+  # 同机任何进程可见；产物侧 identity CLI 须支持环境回退（backend #182）。
+  local dsn_env=()
   if [ "${DB_MODE:-}" = pg ] && [ -n "${DB_DSN:-}" ]; then
-    args+=(--dsn "$DB_DSN")
+    dsn_env=("AGENT_SYSTEM_DSN=$DB_DSN")
   fi
   local out rc=0
-  out="$("$bin" "${args[@]}" 2>&1)" || rc=$?
+  out="$(env ${dsn_env[@]+"${dsn_env[@]}"} "$bin" "${args[@]}" 2>&1)" || rc=$?
   if [ "$rc" -ne 0 ]; then
     c_err "[$ENV_NAME] DB 身份 ensure 失败：$out"
     return 1
@@ -1164,11 +1167,13 @@ svc_db_identity_verify() {
   line="$(svc_db_identity_args)" || return 1
   IFS=$'\t' read -r iid dbref data <<<"$line"
   local args=(identity verify --instance-id "$iid" --dbref "$dbref" --data "$data")
+  # G1-7（U3）：DSN 环境交付同 ensure。
+  local dsn_env=()
   if [ "${DB_MODE:-}" = pg ] && [ -n "${DB_DSN:-}" ]; then
-    args+=(--dsn "$DB_DSN")
+    dsn_env=("AGENT_SYSTEM_DSN=$DB_DSN")
   fi
   local out rc=0
-  out="$("$ENV_BIN" "${args[@]}" 2>&1)" || rc=$?
+  out="$(env ${dsn_env[@]+"${dsn_env[@]}"} "${ENV_BIN:-}" "${args[@]}" 2>&1)" || rc=$?
   if [ "$rc" -ne 0 ]; then
     c_err "[$ENV_NAME] DB 身份校验失败，拒绝启动：$out"
     c_err "  先 scripts/svc.sh $ENV_NAME init（或补跑 ensure）；错库/错实例须人工处置（docs/recovery/u1-identity-manifest.md §5）"
@@ -2243,6 +2248,14 @@ agent_do_deploy() {
     hist_event deploy fail "$(read_pid)" "ui-missing（已回退）"
     return 1
   fi
+  # 首次部署：agent_do_start 的 record_state 建立 svc.env 后，同轮补走 manifest
+  # 领养（ensure 身份行）——否则身份治理要到下一次生命周期动作才生效
+  #（U3 全轨实测：全新 rdm 部署当轮无 manifest）。
+  if ! svc_manifest_migrate; then
+    svc_rollback_deploy "manifest 领养失败（$SRC_LABEL）" || true
+    hist_event deploy fail "$(read_pid)" "manifest 领养失败（已回退）"
+    return 1
+  fi
   svc_release_commit_schema "$relid"
   svc_journal_clear
   svc_release_gc