chore: sync upstream v2026.4.12

[github-actions]

Status: merge conflicts — manual resolution required

Automated sync from upstream stable release v2026.4.12 hit merge conflicts.

Upstream release	https://github.com/openclaw/openclaw/releases/tag/v2026.4.12
Sync branch	sync/upstream-release-v2026.4.12
Workflow run	https://github.com/daydreamsai/dreaming-claw/actions/runs/24385596783

Conflicted files

• docs/cli/index.md
• docs/providers/index.md
• docs/providers/models.md
• pnpm-lock.yaml
• src/agents/pi-embedded-runner/run.ts
• src/commands/auth-choice-options.ts
• src/commands/onboard-types.ts
• src/plugins/bundled-plugin-metadata.generated.ts

Upstream changes (8855 commits)

1c0672b74f test: fix macos parallels gateway fallback
1de5610b24 fix(feishu): guard app registration fetches
ebba080ffc fix(feishu): break auth login barrel cycle
268824ff3a fix(feishu): keep channel auth on local api barrel
78448c0a26 fix(feishu): avoid sdk facade cycles
21ca387eda fix(ci): verify bundled plugin runtime deps
9e2ac8a1cb feat: Streamline Feishu channel onboarding with QR code scan-to-create flow (#65680)
3b9fb972da test(release): align pack size budget assertion
645c7b1897 fix: harden qmd service startup
2e1b5407dd fix: preserve qmd command paths
380de88a61 fix: extract shared session status runtime (#65807)
ae3b10c15c fix(docker): install bundled plugin deps after prune
431db078f2 [codex] Fix LM Studio header-auth follow-ups (#65806)
abe33319d3 fix(release): allow matrix runtime pack size
ee601ae993 fix(matrix): mirror staged runtime dependencies
45f800f4f8 fix(matrix): sync runtime dependency lockfile
d63394247e fix(build): refresh a2ui bundle hash
98c2a38bc3 fix(matrix): mirror runtime deps for docker builds
e36f2f92c5 chore(release): restore 2026.4.11 appcast
72e56097ec chore(release): prepare 2026.4.12
ddb7a8dd80 Feat/fix qq ssrf url list (#65788)
0cfb83edfa feat: LM Studio Integration (#53248)
5b92dbaeee docs:add maintainer info (#65762)
83f6a26d77 qa: keep OpenAI live defaults when auth exists
ae4b997a00 qa: prefer codex auth for live defaults
666f48d9b8 fix(security): remove busybox/toybox from interpreter-like safe bins [AI-assisted] (#65713)
0a105c0900 fix(approval-auth): prevent empty approver list from granting explicit approval authorization [AI] (#65714)
8f8492d172 fix(security): broaden shell-wrapper detection and block env-argv assignment injection [AI-assisted] (#65717)
6640b35298 qa: wait for repo-contract artifact signals
eede525970 qa: relax repo-contract artifact matcher

Resolution

git fetch origin sync/upstream-release-v2026.4.12 && git fetch upstream --tags
git checkout -B sync/upstream-release-v2026.4.12 origin/sync/upstream-release-v2026.4.12
git merge --no-ff --no-edit refs/tags/v2026.4.12
# resolve conflicts, then:
git rm .upstream-sync-pending || true
git commit
git push origin sync/upstream-release-v2026.4.12

Mark this PR as Ready for review once conflicts are resolved.

---

This PR was created by .github/workflows/upstream-release-sync.yml.