feat(adapters): OpenClaw before_tool_call plugin with fail-closed subprocess bridge

[fu351]

Slice

• Repo: doberman-core
• Feature / Slice: ADR 0038 — OpenClaw adapter bridge (no numbered F* slice; cross-cutting adapter feature tracked via ADR)
• Plan reference: ADR 0038 (doberman-vault/Decisions/0038-openclaw-adapter-bridge.md), doberman_implementation_plan.md

What this PR does

Adds an OpenClaw plugin (adapters/openclaw/) that registers a before_tool_call hook and gates every OpenClaw tool call through Doberman's existing PASS/AUTH/BLOCK decision engine, via a fresh doberman hook openclaw subprocess per call (mirrors the existing Claude Code hook adapter's architecture).

• src/doberman/hosthooks/openclaw.py: parses the before_tool_call event JSON on stdin, normalizes built-in tools to SecurityObject, and reuses claude_code.py's exact decision pipeline (decide, apply_taint_floor, resolve_enforcement_sync, acted_verdict). Always emits exactly one JSON verdict on stdout; never raises.
• src/doberman/cli/main.py: new doberman hook openclaw command.
• adapters/openclaw/openclaw.plugin.json + package.json + index.js: the OpenClaw plugin manifest, package.json's openclaw.extensions entry-point wiring, and a plain ESM bridge (no build step) that spawns the Python hook with a 10s timeout (under OpenClaw's own 15s hook timeout budget) and fails closed on any spawn error, timeout, non-zero exit, or unparseable stdout.
• adapters/openclaw/README.md: install steps, verdict mapping, and a mandatory "verify it's live" canary check — motivated by OpenClaw #5513 (plugin hooks can silently never fire) and #20914 (a plugin that fails to load leaves OpenClaw running with zero interception, logged but otherwise silent).
• Root README.md: new "Alternative: enforce via OpenClaw" section + roadmap bullet.

Per ADR 0038 (amended after a build-time doc-verification check caught the original design's mistake): packaged as a real OpenClaw plugin, not a HOOK.md hook-pack — hook-packs can only reach lifecycle/command events, never before_tool_call. That would have shipped a silent fail-OPEN adapter.

Verdict mapping: PASS -> allow (no-op); BLOCK -> {block: true, blockReason}; AUTH -> OpenClaw's own native requireApproval (allowedDecisions: ["allow-once", "deny"] only -- no "allow-always" in this slice), not Doberman's own GUI/TTY challenge.

Tests added (run in CI)

• tests/unit/test_hosthook_openclaw.py (40 tests): event parsing/normalization for built-in tools, fail-closed behavior on malformed/missing/unknown fields, redaction (no secret ever appears in a verdict), the "exactly one JSON document on stdout" contract, PASS/AUTH/BLOCK verdict shaping, and monitor-mode history recording parity with the Claude Code hook.

Public-release safety (doberman-core only)

• Contains nothing from the "not allowed" list: no enterprise/hosted code, no proprietary detection, no customer data, no secrets, no commercial-license code
• Core still builds/tests/runs with NO enterprise package installed

Security checklist

• Fails closed on error / uncertainty
• No secret, full file, or unredacted prompt logged or committed
• Any guardrail/learning change is raise-only (no silent loosening) -- N/A, no guardrail/learning logic changed, this is a new host-adapter surface reusing the existing decision pipeline unmodified
• Every BLOCK/AUTH carries reason codes + a human explanation
• doberman-core does not import doberman_enterprise

Edge cases covered / Deviations from plan / Risks introduced

Edge cases: malformed/non-JSON stdin, missing/non-string tool_name, unrecognized tool names (normalized generically, never silently passed), missing required per-tool fields (e.g. exec without command), missing derived_paths for path-bearing actions, subprocess spawn failure, subprocess timeout, non-zero exit, unparseable stdout -- all fail closed.

Deviations from the original design sketch:

• Denylist-abstain model: only an explicit _ABSTAIN_TOOLS set abstains from evaluation; everything else -- including tool names Doberman doesn't recognize -- is evaluated for real rather than allowlisted through. Nothing unrecognized silently passes.
• AUTH is delegated to OpenClaw's own requireApproval/onResolution flow instead of Doberman's synchronous challenge, since OpenClaw's approval resolves asynchronously outside this subprocess's lifetime.
• AUTH-outcome history recording is out of scope for this slice (documented in the adapter README under "Known limitations") -- the subprocess exits before an async approval resolves, so only BLOCK verdicts are recorded to history from this hook today.
• web_fetch's params.url key is best-effort/unconfirmed against OpenClaw's actual event shape (flagged both in code comments and the adapter README); every other field mapping (toolName, params, toolKind, derivedPaths, before_tool_call's BeforeToolCallResult shape) was verified directly against current docs.openclaw.ai.

Risks: the OpenClaw plugin/event contract was verified against live documentation this session (not assumed from training data), but has not been tested against a real running OpenClaw instance (no local OpenClaw install available in this environment) -- the adapter README's canary check exists specifically so an operator confirms real interception before trusting it.