Block a user
fix(ci): unwire test-start-agent-session.sh, restore its signed exclusion — unblocks every PR on next
Exact-head verdict: APPROVE
fix(fleet): seed unattended identity on first start (#1264)