Having visited many incident command and crisis centers locally and abroad, the only button on the desk I have seen is for operators to open the door for visitors.

I think the issue is a procedural thing. Somebody needs to verify training, test and active mode of the systems before the buttons are pushed.

The system interface might need to have big highlights about the mode being used. However active mode is the default, so that might not trigger somebody that they aren't in training or a test mode. So this is of limited use. Having a giant blinker saying you are real mode all the time, basically makes people not see it any more pretty quickly.

A physical switch can be added to the system and procedure. A training or test can start with a coordinator manually switching and a second person verifying. This might include a switch controlled by a key.

Actively making test mode different, means people never actually get to use the real thing and means things go wrong when something does happen. It also makes it virtually impossible to test the system correctly.

Having a completely independent identical training setup can help, but is expensive. I have seen duplicate systems also being the backup system but completely separated. The computer systems were made to be able to pull out of the training server rack and inserted in the 'real' rack as emergency replacements. But somehow that system was never really working well in practice and the software always seems to be different in the training one.