secret-rotation

• GHSA-xmxx/GHSA-mr34/GHSA-2gvc - OpenClaw gateway boundary hardening 2026-05-08
• GHSA-xh72/GHSA-xmxx - OpenClaw agent-surface fail-closed bypasses 2026-05-02