Why: env -i dropped RDM_DISABLE_EXEC_TOOLS, so the real RDM binary exited immediately on runners without bwrap, and the capability probe now prints the JSON document. Evidence: SELF bash -n scripts/svc.sh; python3 -m py_compile tests/test_svc_realcombo.py. GATE run 2656 job 3831 failed on the previous head before this fix. Impact: serve and the lifecycle child forward that one switch; identity capabilities is checked as protocol 1 JSON. Refs: #485 Co-authored-by: Cursor <cursoragent@cursor.com>