Resolve realcombo paths inside CI run scripts

Why: YAML env: values do not shell-expand, so $PWD-based binary paths
reached the suite as literal strings (run 2606: SVC_REAL_BIN not
executable).
Evidence: job log run 2606; paths now exported in the run script.
Impact: ci.yaml only.

.gitea/workflows/ci.yaml

@@ -409,12 +409,12 @@ jobs:
           make -C rdm build
       - name: Real-combination identity gates over real PostgreSQL (U3, required)
         env:
-          SVC_TEST_REAL: "1"
-          SVC_TEST_PG: "1"
-          SVC_REAL_RDM_BIN: $PWD/rdm/bin/agent-system-rdm
           AGENT_PG_TEST_DSN: postgres://ci_agent:ci_job_local_only@127.0.0.1:5432/agent_test?sslmode=disable
         run: |
           set -euo pipefail
+          # 路径变量在脚本内解析（YAML env: 不做 shell 展开）。
+          export SVC_TEST_REAL=1 SVC_TEST_PG=1
+          export SVC_REAL_RDM_BIN="$PWD/rdm/bin/agent-system-rdm"
           python3 -m unittest tests.test_svc_realcombo -v
 
   # U3（统一部署方案）：真实 Dev/RDM 制品的 svc.sh 生命周期门禁——桩套件
@@ -616,11 +616,11 @@ jobs:
           unset SUBMODULE_TOKEN
           make -C rdm build
       - name: Run real-combination lifecycle gates (SQLite, U3, required)
-        env:
-          SVC_TEST_REAL: "1"
-          SVC_REAL_BIN: $PWD/bin/agent-system
-          SVC_REAL_RDM_BIN: $PWD/rdm/bin/agent-system-rdm
-          SVC_RDM_ORIGIN: $PWD/rdm
         run: |
           set -euo pipefail
+          # 路径变量在脚本内解析（YAML env: 不做 shell 展开）。
+          export SVC_TEST_REAL=1
+          export SVC_REAL_BIN="$PWD/bin/agent-system"
+          export SVC_REAL_RDM_BIN="$PWD/rdm/bin/agent-system-rdm"
+          export SVC_RDM_ORIGIN="$PWD/rdm"
           python3 -m unittest tests.test_svc_realcombo -v