Add read-only Gateway isolation status plugin

[ChazGo]

What Problem This Solves

The packaged Windows Gateway needs to report the session mode selected by its launcher without giving the Gateway any ability to change, disable, or escape that isolation boundary. It also needs an obvious Control UI surface rather than relying on the generic plugin inventory.

Why This Change Was Made

• The launcher now reports its process-stable launch selection through CLAWCTL_GATEWAY_ISOLATION, with the exact values enabled and disabled.
• A Windows-packaging-owned bundled plugin reads that value once, exposes one authenticated read-only HTTP route, and contributes a sandboxed Gateway Isolation tab in the Control group.
• The plugin registers no Gateway methods, tools, services, mutation RPCs, broker, state store, or enable/disable control. Missing or invalid launcher values fail closed with HTTP 503.
• Payload composition provisions the plugin into OpenClaw's supported dist/extensions directory and asks the selected OpenClaw runtime to verify that the bundled plugin loads with exactly one HTTP route and no capability surfaces. This also rejects incompatible manual openclaw_ref overrides.
• The wording, inverse CLI command, status tones, and copy affordance follow feat(ui): show reported Gateway isolation openclaw/openclaw#144243. The session-switch command and immediate restart behavior remain intentionally out of scope for this status/reporting change.

User Impact

The Control sidebar shows Gateway Isolation with Reported Gateway Isolation: Enabled or Disabled, plus the approved Change with CLI guidance. The current interactive-user-session launcher path truthfully reports disabled; a future isolated agent-session launcher can pass the typed Enabled mode without changing the plugin.

This is diagnostic reporting only. It does not claim cryptographic attestation or independently verify the security boundary.

Evidence

• .NET launcher suite: 54 passed
• Plugin Node suite: 6 passed
• Signing policy tests: passed
• Workflow package-version tests: passed
• Synthetic x64/ARM64-independent payload provisioning: passed
• Real pinned OpenClaw 2026.8.2 payload: built successfully with 36,777 files / 785.8 MiB
• Real runtime inspection: bundled, default-enabled, activated, loaded, imported, one HTTP route, and zero Gateway methods, tools, services, or diagnostics
• Fresh review completed after clipboard and runtime-compatibility hardening

A direct rendered disabled-state screenshot is attached below. A full Control shell screenshot was not feasible with the available successful upstream artifact: its Control UI and Gateway builds had different build timestamps despite sharing the same commit, so the Gateway rejected the client build with close code 4008 and forced a reload. The plugin itself loaded and its authenticated route rendered successfully.

[ChazGo]

Superseded by openclaw#28, which correctly targets the upstream repository.