Add OpenClaw sandbox backend example

[opencolin]

Adds examples/openclaw-tenki: the @tenkicloud/openclaw plugin makes Tenki the sandbox backend for OpenClaw — with sandbox.mode: "all", every agent shell/file/PTY operation runs in a per-scope microVM, found-or-resumed by tag.

verify.mjs needs no OpenClaw host: it asserts the published package's plugin-manifest contract, then drives the live path the backend rides — tagged create, find-by-tag, sh -c with the set -- args prefix, stdin staged through a session file, SSH cert mint plus gateway stream, dispose. Every mirrored call was cross-checked against the plugin source in the npm tarball. Passed live.

The README is explicit that this is a ClawHub community plugin (upstream openclaw#111792 was closed), and notes the plugin's SDK 0.5.2 pin vs the example's ^0.5.4.

Root README: OpenClaw row in Agent platforms (shared table with #8/#15 — later merges rebase trivially).

🤖 Generated with Claude Code

[tenki-reviewer]

Review complete. No blocking issues — approved ✅; 1 nitpick below.

🧹 Nitpicks (1) — 🟢 1 low

• 🟢 SSH cert validity and banner timeout never fail the verify (verify.mjs:107) — verify.mjs line 107 only asserts cert.sshCert.startsWith("ssh-ed25519-cert") after issueSandboxSSHCert (line 106); it never decodes the OpenSSH certificate to check the valid-after/valid-before window, key id/principals, or CA signature, so an expired or wrongly-principaled cert still passes.

---

This PR adds a self-contained cookbook example (examples/openclaw-tenki/) demonstrating how to drive the @tenkicloud/sandbox backend from a plain Node script, with documentation in the root README and an example-specific README covering setup and the verify script.

Files	Change
README.md	Adds a short pointer to the new openclaw-tenki example under the sandbox examples.
examples/openclaw-tenki/README.md	Documents prerequisites, the TENKI_AUTH_TOKEN/tenki login auth paths, workspace setup, and how to run npm run verify.
examples/openclaw-tenki/package.json	Declares the verify script and the @tenkicloud/openclaw and @tenkicloud/sandbox dependencies.
examples/openclaw-tenki/verify.mjs	Proves the plugin manifest contract, find-by-tag reuse, /bin/sh -c positional args, stdin staging, and ed25519+short-lived-cert SSH over the gateway stream; cleans up keys and the session in a finally block.

_{Reviewed commit: 44aaf55}