feat(agent-test): add a bounded OpenClaw connector

Description

The pitch.

## Problem

Testing an existing OpenClaw agent needs a bounded connector that checks the behavior Town relies on without locking users to one release or guessing across incompatible routes, retries, or output envelopes.

## Change

- accept any bounded, parseable OpenClaw version and report the detected version
- require the CLI, Gateway, and RPC versions to agree; validate optional server and plugin versions when reported
- require local Gateway mode, reject configured Gateway URL overrides, and clear inherited overrides before turns
- use bounded no-shell subprocesses, private prompt files, strict canonical intents, and strict characterized envelopes
- reject fallback, remote dispatch, reported activity, malformed sessions, and version/model drift without retrying a turn with alternate syntax

## Verification

- final stack: `make ci-local` — all 5 checks passed; 2,081 passed, 2 skipped, 1 deselected
- focused connector suite: 143 passed; subprocess suite: 25 passed, including concurrent cleanup stress
- coherent alternate-version installed-process E2E and clean archive/installed-wheel quickstart: PASS
- independent final connector/version review: READY, no Critical or Important findings

## Stack

**7 of 9. Depends on PR 6.** PR 8 bridges the prepared runtime into Town; PR 9 exposes the command and guide.

**Merge note:** After #225 merges into `main`, retarget this PR to `main`, wait for its CI, and only then merge it.