weichen
99bbbc089e
Why: stub suites proved the script logic but not real artifact behavior (the 2026-10-12 incidents passed all stub tests); the report's U3 requires real-combination gates, and realcombo dry-runs exposed two real gaps: fresh deploys closed identity governance one lifecycle late, and pg-bound identity calls put the DSN on the command line. Evidence: make test exit 0; local realcombo dry-run 16 OK (rows in the task card); CI adds svc-realcombo (SQLite, both real binaries, full RDM track) and a real-PG identity step on test-pg with env-delivered DSN. Impact: tests/test_svc_realcombo.py (SVC_TEST_REAL gate, explicit NOT_RUN otherwise); ci.yaml new job + test-pg step (RDM clone via trusted-base URL-scoped token header, allowlist addition reviewed in this PR); svc.sh delivers identity DSN via AGENT_SYSTEM_DSN and runs manifest adoption in the same deploy that first registers svc.env; modules/backend pinned to main (env fallback, backend #182). Refs: .task/feature-svc-u3-realcombo.md; user goal directive 2026-10-12 (U3); backend #182; RDM #285.
ui
@ 83e80f5648