feat(chat): add safe correlated OpenClaw Gateway dispatch

[CompleteDotTech]

DO NOT MERGE - INCOMPLETE DRAFT

Scope and pinned compatibility profile

This PR adds a chat-only, fail-closed direct OpenClaw Gateway dispatch foundation. It pins official published packages:

• @openclaw/gateway-client@2026.7.2-beta.4
• @openclaw/gateway-protocol@2026.7.2-beta.4
• typebox@1.3.6
• wire protocol v4 only

The dispatcher validates published HelloOkSchema and ChatEventSchema, exact v4 negotiation, operator role, operator.read/operator.write, chat.send, chat.abort, sessions.messages.subscribe, the versioned chat event, and GATEWAY_SERVER_CAPS.CHAT_SEND_ROUTING_CONTRACT. A frame is accepted only when its exact (sessionKey, agentId, runId) matches the run returned by chat.send.

Completed and evidenced

• Stable Cave runId is the Gateway idempotencyKey; callers without one safely retain CLI/plain-chat.
• A sent-but-unacknowledged chat.send is indeterminate and never starts a replacement CLI turn; compatibility, auth, client-construction/startup, and subscription failures before dispatch retain fallback.
• Foreign same-session runs, malformed, replayed, out-of-order, gapped, unsupported, disconnected, and pre-resubscription frames fail closed. Behavioral regressions prove frames delivered after transport close are dropped and never replayed after reconnect.
• Cancellation settles before chat.abort; late terminal frames cannot overwrite cancelled state.
• Gateway process settings are removed from CLI fallback, including all OPENCLAW_GATEWAY_* settings and Vault/allow-list restoration paths.
• Gateway route scaffolding preserves stop registry, stream resume, first-turn stub, identity, response metadata, transcript persistence/naming, work-branch capture, and cancelled flags.

Deliberate security boundary / unresolved acceptance criteria

This PR does not complete #3865 and must remain a draft.

1. The exact published 2026.7.2-beta.4 protocol tarball contains no versioned session.tool event/payload validator. Cave ignores tool-shaped frames and emits no Gateway tool cards.
2. Cave has no verified cross-platform OS-backed paired-device identity/token store. The official client's GatewayClientHostDeps requires host-owned identity creation, challenge signing, and token load/store/rotation/clear. The direct path therefore fails closed before client construction; Gateway env tokens, passwords, bootstrap/device tokens, private keys, and signing values cannot activate it.

No plaintext credential storage, .env activation, unencrypted config, or credential logging is added. CLI/plain-chat remains the fallback.

Review, CI, and local validation

• Reviewed Implement direct Gateway-dispatched OpenClaw tool activity #3865, Add full OpenClaw tool-activity compatibility #3847, chore(chat): retain OpenClaw CLI fallback stop point #3852, reference PR feat(chat): dispatch OpenClaw turns through Gateway #3866, the full implementation and callers, lockfile, and exact official npm tarballs. GraphQL review-thread inspection found no comments, review submissions, or unresolved threads.
• Review remediation: post-close transport callbacks previously could be buffered then replayed after a reconnect subscription. Commit 58e0fdf68fee448ac7444670e2ad32c27f355eab drops them because they lack transport-generation provenance. Commit f55039c938a28aaa2b223a9a9a34d8f61e76221b additionally converts synchronous Gateway construction/start failures into pre-dispatch unavailability, stops a partially started client, and retains CLI fallback.
• Rebased cleanly onto origin/main@147809878f3fc29d691323421c9bb9ab2cc9e59c; branch head is f55039c938a28aaa2b223a9a9a34d8f61e76221b.
• Passed: Gateway/bin/bridge, routing, first-turn-stub, stream-resume (5 behavioral tests using the alias loader), API-contract, and work-branch tests; pnpm check:tests-wired (1254), pnpm exec tsc --noEmit --pretty false, pnpm lint, and git diff --check.
• pnpm test:api reaches a native-Windows failure in unchanged scripts/dev-app-teardown.test.mjs before affected tests: fake dev-server bind timeout (branch port 58033). Current origin/main@147809878f3fc29d691323421c9bb9ab2cc9e59c fails in the same unchanged test after a frozen install (Windows EPERM removing its temporary fixture), so it is not attributable.
• CI 30217506119 (including Frontend full app/API/mobile/build, E2E, cross-environment, Rust, and sidecar jobs) and CodeQL 30217506126 passed for 58e0fdf68fee448ac7444670e2ad32c27f355eab. The rebase cancelled the prior in-flight run; fresh CI is queued for f55039c938a28aaa2b223a9a9a34d8f61e76221b.

Keep this PR draft and do not close #3865 until both external blockers are resolved.