fix: nightly hardening - strict skill config root validation

[mouse-value-add]

Problem

The skill installer accepted any valid JSON value as config, including scalars and arrays. That creates brittle behavior when users have malformed-but-parseable config files, and risks mutating an unexpected structure during install/uninstall.

Approach

• Hardened to require a JSON object root.
• Treat non-object roots (, arrays, scalars) as invalid config via .
• Added tests that assert rejection of scalar and array roots.

Verification

• Ran full test suite:
  RUN v2.1.9 /Users/mouse/.openclaw/workspace/tmp-nightly/you.md

✓ test/parser/yaml.test.ts (12 tests) 3ms
✓ test/core/validator.test.ts (10 tests) 3ms
✓ test/cli/skill.test.ts (10 tests) 8ms
✓ test/core/discovery.test.ts (13 tests) 4ms
✓ test/parser/markdown.test.ts (11 tests) 8ms
✓ test/cli/wizard.test.ts (12 tests) 4ms
✓ test/cli/check.test.ts (4 tests) 9ms
✓ test/core/signals.test.ts (21 tests) 11ms
✓ test/core/parser.test.ts (16 tests) 27ms
✓ test/core/merger.test.ts (4 tests) 2ms
✓ test/parser/frontmatter.test.ts (7 tests) 1ms
✓ test/core/known-sections.test.ts (4 tests) 2ms
✓ test/cli/templates.test.ts (6 tests) 2ms
✓ test/parser/loadFromUrl.test.ts (3 tests) 10ms
✓ test/cli/skill-status.test.ts (1 test) 10ms
✓ test/parser/timeout.test.ts (3 tests) 4ms
✓ test/mcp/server.test.ts (7 tests) 2ms

Test Files 17 passed (17)
Tests 144 passed (144)
Start at 13:32:05
Duration 655ms (transform 341ms, setup 0ms, collect 827ms, tests 109ms, environment 3ms, prepare 788ms)

• Result: 17 files passed, 144 tests passed.

Risks

• Users with non-object JSON roots in tool config will now see a clear config-corruption error instead of best-effort mutation.

Rollback plan

• Revert this PR to restore previous permissive parsing behavior.
• If needed, follow up with a migration helper that auto-wraps known invalid roots into a safe object.