Make OpenClaw plugin registration synchronous; add manifest resolver and compat fixes

[G9Pedro]

Motivation

• Restore compatibility with OpenClaw by ensuring register(api) returns the plugin object synchronously instead of a Promise.
• Repair drift between package.json and the compatibility checker so the shipped manifest path is validated correctly.
• Prepare a small capability-oriented runtime scaffold to keep registration fast and make future extensibility safer.
• Update docs and diagnostics so native plugin enablement is the canonical path and legacy hook flows are clearly labeled compatibility-only.

Description

• Changed the OpenClaw registration path to be synchronous by removing async from the registration surface and routing native wiring through a tiny runtime bootstrap (src/openclaw-plugin.ts, src/plugin/runtime.ts).
• Introduced a manifest/package resolver and helper (src/plugin/openclaw-manifest.ts) and refactored the compat checks to validate package.json#openclaw.plugin and openclaw.extensions and the actual shipped manifest path (src/commands/compat.ts).
• Replaced monolithic hook wiring with a capability registration model where tools, prompt-recall, message-filter, lifecycle, and observation capabilities are registered via registerOpenClawCapabilities.
• Kept the legacy memory-slot registration path intact and exported a programmatic registerOpenClawPlugin for downstream reuse (src/openclaw-plugin.ts).
• Hardened runtime/doctor behavior to prefer the native plugin slot model and updated doctor hints to instruct operators to use openclaw config set plugins.allow + openclaw config set plugins.slots.memory when appropriate (src/commands/doctor.ts).
• Updated and hardened tests to assert the synchronous registration contract and to exercise the new package/manifest validation behavior (src/openclaw-plugin.test.ts, src/commands/compat.test.ts).
• Refreshed user-facing documentation and security/release guidance to present native OpenClaw plugin enablement as the canonical flow and to include a release checklist for manifest/extension alignment (README.md, SKILL.md, docs/openclaw-plugin-usage.md, docs/getting-started/installation.md, docs/clawhub-security-release-playbook.md, SECURITY.md).

Testing

• Ran type-checking with npm run typecheck and it succeeded.
• Built the distribution with npm run build and the build completed successfully (generated dist/openclaw-plugin.js and DTS artifacts).
• Executed unit tests for the changed areas with npx vitest run src/openclaw-plugin.test.ts src/commands/compat.test.ts and all tests passed (9 passed).
• Note: a full npm install attempted to fetch an onnxruntime artifact and failed due to network restrictions in the environment, so npm install --ignore-scripts was used to proceed with local validation; this network failure did not affect the TypeScript/type/DTS build or the targeted tests above.

---

Codex Task