Pass the PG DSN via environment instead of the command line (G1-7)

Why: the plan section 3.4 observed the local dev service carrying the
credential-bearing DSN as a serve --dsn argument, visible to any
process on the host (ps / /proc/<pid>/cmdline) — including scripts
generated by agents. The base config layer already supports
AGENT_SYSTEM_DSN, so the launcher can move the secret out of the
argument vector without touching the binary.

Evidence: bash -n clean; make test-governance 104/104 green; an
end-to-end probe with a stub binary and a legacy exec= carrying
--dsn ...secret... shows the migration stripping the flag
(MIGRATED:yes), the process args free of the secret
(NO-LEAK-IN-CMDLINE), and AGENT_SYSTEM_DSN present in the process
environment (DSN_IN_ENV:yes). New/rebuilt launches never put the DSN
in argv; legacy persisted configs are migrated on first reuse.

Impact: scripts/svc.sh only — rebuild path sets DSN_ENV instead of
--dsn, reuse path strips --dsn from stored exec= once and logs the
migration, launch injects AGENT_SYSTEM_DSN alongside the existing
guard vars. CLI --dsn still wins inside the binary (config
precedence), so manual invocations are unchanged.

Refs: plan G1-7 (line 356) and section 3.4 (2026-10-09 ps
observation); backend config AGENT_SYSTEM_DSN.

scripts/svc.sh

@@ -1222,7 +1222,15 @@ agent_do_start() {
   local exec_args
   if ! agent_has_explicit_cfg && [ -n "$(svc_get exec)" ]; then
     exec_args="$(svc_get exec)"
-    c_info "[$ENV_NAME] 复用上次配置（svc.env exec=；显式参数可覆盖）：$(mask_dsn "$exec_args")"
+    # G1-7：存量 exec= 里的 --dsn 剥离到环境变量（迁移；命令行不再可见明文）。
+  case "$exec_args" in
+    *--dsn\ *)
+      DSN_ENV="$(printf '%s' "$exec_args" | sed -n 's/.*--dsn \([^ ]*\).*/\1/p')"
+      exec_args="$(printf '%s' "$exec_args" | sed 's/--dsn [^ ]*//' | sed 's/[[:space:]]\{2,\}/ /g; s/^ //; s/ $//')"
+      c_info "[$ENV_NAME] DSN 已从命令行迁移到环境变量（G1-7）"
+      ;;
+  esac
+  c_info "[$ENV_NAME] 复用上次配置（svc.env exec=；显式参数可覆盖）：$(mask_dsn "$exec_args")"
   else
     local args=""
     if [ "$CLI_MOCK" = 1 ] || [ "$(env_var "$ENV_NAME" MOCK)" = "1" ]; then
@@ -1241,7 +1249,11 @@ agent_do_start() {
           c_warn "[$ENV_NAME] dbref=$(svc_get dbref) 无法重建 DSN（实例缺失或登记不全），按无数据库绑定启动"
         fi
       fi
-      [ -n "$dsn" ] && args="$args --dsn $dsn"
+      # G1-7：DSN 经环境变量传入（AGENT_SYSTEM_DSN），不再进命令行——命令行对
+      # 同机任何进程可见（含智能体生成脚本的 /proc/<pid>/cmdline），2026-10-09
+      # 方案 §3.4 实测。基座 config 优先级 CLI>env，旧 exec= 里的 --dsn 仍生效
+      # （向后兼容），但新建/重建的启动配置从此不带 DSN 明文。
+      DSN_ENV="$dsn"
       if [ -n "$dsn" ] || [ -n "$auth" ] || [ "$ENV_NAME" != dev ]; then
         [ -z "$auth" ] && auth=auto
         args="$args --auth $auth"
@@ -1282,7 +1294,9 @@ agent_do_start() {
   fi
   # 直接 nohup 简单命令：$! 即服务进程本身，pidfile 语义才成立。
   # 守卫变量走环境，不写进 exec=；旧二进制不认识这两个变量，会忽略。
-  if [ "${#guard_env[@]}" -gt 0 ]; then
+  # G1-7：DSN 同样走环境（AGENT_SYSTEM_DSN；基座 config 环境档已支持）。
+  [ -n "${DSN_ENV:-}" ] && guard_env+=("AGENT_SYSTEM_DSN=$DSN_ENV")
+  if [ "${#guard_env[@]}" -gt 0 ];then
     nohup env "${guard_env[@]}" "$ENV_BIN" serve $exec_args >> "$ENV_DIR/svc.log" 2>&1 &
   else
     nohup "$ENV_BIN" serve $exec_args >> "$ENV_DIR/svc.log" 2>&1 &