No executed-script test row for the accepted control-apply path

[VijitSingh97]

The accepted control-apply path has no test row that runs control-apply as an executed script, so errexit and the ERR trap are never armed for it.

Found during the non-author review of #433.

The gap

#433 added tests/run.sh:8620, which drives bash "$SCRIPT" control-apply as a separate process —
errexit live, ERR trap armed. That row covers the rejection path only.

Every applied / rolled_back / fast-path row still goes through ca_exec
(tests/run.sh:8434), which sources rigforge.sh. Sourcing sets _RIGFORGE_SOURCED=1, so the
ERR trap at rigforge.sh:174 is never armed, and ca_exec then does set +e immediately before
calling control_apply.

That is the same blind shape #433's body indicts for the rejection path: it exercises the branch with
the mechanism that kills it in production switched off. It is fine as evidence about orchestration —
which status is written, which files move — and it is not evidence about errexit behaviour on the
accepted path.

Why it matters

The companion follow-up (unguarded commit tail) is exactly a defect on the accepted path that this
shape cannot see: the sabotaged run returns 0 and records applied, and no sourced-and-set +e row
would notice.

Suggested shape

Add at least one executed-script row for the accepted path, following the #210 precedent already in
the file and the one #433 added at tests/run.sh:8620. Do not wrap it in a subshell — the #364
comment explains why (bash 5.2 carries a suppressed errexit context into $( ) and 3.2 does not,
which disarms the failure under test on one platform).