feat(agent-test): test an existing OpenClaw agent from the CLI

Description

The pitch.

## Problem

The headline workflow should be one clear command for a terminal-comfortable developer, not a private bridge or hand-edited adapter.

## Change

- add `nest test agent <agent-id>` with safe OpenClaw autodetection and explicit `--runtime openclaw`
- try the installed OpenClaw version and validate the required command/JSON behavior instead of using a release allowlist
- keep the frozen workflow internal to the friendly default while retaining advanced endpoint/profile controls
- add a short beginner guide, separate technical reference, actionable recovery messages, and installed-process checks

## Verification

- final stack: `make ci-local` — all 5 checks passed; 2,081 passed, 2 skipped, 1 deselected
- clean committed-archive/installed-wheel quickstart: PASS
- installed-process E2E passes with a coherent alternate version string and the public autodetected command
- real Linux acceptance with an existing configured OpenClaw `2026.7.1-2` agent: exact public command passed all five stages
- result schema/profile validation, trace digest, 18-event trace, artifact modes, and secret scan passed; Gateway PID/restart count was unchanged
- independent final product/security/version reviews found no Critical or Important issues

## Scope

**9 of 9. Depends on PR 8.** This proves one bounded synthetic sell/buy workflow through Town. It does not promise every historical OpenClaw command shape, and it does not claim general agent compatibility, verified model identity, absence of unreported tool activity, public-network delivery, safety, trust, or long-term reliability.

**Merge note:** After #227 merges into `main`, retarget this PR to `main`, wait for its CI, and only then merge it.