[WIP] Fix automated tests for OpenClaw upgrade to 2026.3.11

[Copilot]

Thanks for assigning this issue to me. I'm starting to work on it and will keep this PR's description up to date as I form a plan and make progress.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>⚠️ OpenClaw 2026.3.11 upgrade failed automated tests</issue_title>
<issue_description>## Automated Upgrade Failed: 2026.2.9 → 2026.3.11

Failed stage: Docker smoke tests
Workflow run: https://github.com/vhrahulkumar/openclaw-appplatform/actions/runs/23508975503

Test Output

=== OpenClaw Upgrade Verification ===

Waiting for container openclaw-upgrade-test to be ready...
✓ Container is responsive (waiting for init to complete...)
✓ s6 init complete (crond up)
✓ Version: 2026.3.11
✓ Config is valid JSON
FAIL: tools.profile is 'null' (expected 'coding')
✓ Config owned by openclaw
✓ Auth mode: token
✓ Gateway process running
✓ Tailscale binary present
Waiting for gateway HTTP...
✓ Gateway HTTP: 200
✓ Config writable by openclaw user
✓ Channel plugins loaded: discord,signal,telegram,whatsapp
✓ Backup config (backup.yaml) is valid
WARN: pnpm store may not be excluded from backups
SKIP: Telegram channel probe (TELEGRAM_BOT_TOKEN not set)
✓ openclaw doctor completes

=== Upgrade Verification Results ===
  Passed:   11
  Failed:   1
  Warnings: 1

=== UPGRADE VERIFICATION FAILED (1 failures) ===

Known Regressions

• vhrahulkumar/openclaw-appplatform#44708: [Bug]: Telegram media download broken since 2026.3.11
• vhrahulkumar/openclaw-appplatform#45287: [Bug]: 2026.3.12 update rolls back during gateway CLI verification: plugins.slots.memory: plugin not found: memory-core
• vhrahulkumar/openclaw-appplatform#44096: Hot reload sends SIGTERM to gateway on every config evaluation (2026.3.11)
• vhrahulkumar/openclaw-appplatform#47402: [Bug]: WebSocket device auth regression in 2026.3.13 breaks web dashboard connections
• vhrahulkumar/openclaw-appplatform#50541: [Bug]: CLI cannot connect to Gateway (missing scope: operator.read) - Downgrade to 2026.3.11 works

Release Notes

2026.3.23

Breaking

Changes

• ModelStudio/Qwen: add standard (pay-as-you-go) DashScope endpoints for China and global Qwen API keys alongside the existing Coding Plan endpoints, and relabel the provider group to Qwen (Alibaba Cloud Model Studio). (#43878)
• UI/clarity: consolidate button primitives (btn--icon, btn--ghost, btn--xs), refine the Knot theme to a black-and-red palette with WCAG 2.1 AA contrast, add config icons for Diagnostics/CLI/Secrets/ACP/MCP sections, replace the roundness slider with discrete stops, and improve accessibility with aria-labels across usage filters. (#53272) Thanks @BunsDev.
• CSP/Control UI: compute SHA-256 hashes for inline <script> blocks in the served index.html and include them in the script-src CSP directive, keeping inline scripts blocked by default while allowing explicitly hashed bootstrap code. (#53307) Thanks @BunsDev.

Fixes

• Plugins/bundled runtimes: ship bundled plugin runtime sidecars like WhatsApp light-runtime-api.js, Matrix runtime-api.js, and other plugin runtime entry files in the npm package again, so global installs stop failing on missing bundled plugin runtime surfaces.
• CLI/channel auth: auto-select the single configured login-capable channel for channels login/logout, harden channel ids against prototype-chain and control-character abuse, and fall back cleanly to catalog-backed channel installs, so channel auth works again for single-channel setups and on-demand channel installs. (#53254) Thanks @BunsDev.
• Auth/OpenAI tokens: stop live gateway auth-profile writes from reverting freshly saved credentials back to stale in-memory values, and make models auth paste-token write to the resolved agent store, so Configure, Onboard, and token-paste flows stop snapping back to expired OpenAI tokens. Fixes vhrahulkumar/openclaw-appplatform#53207. Related to vhrahulkumar/openclaw-appplatform#45516.
• Control UI/auth: preserve operator scopes through the device-auth bypass path, ignore cached under-scoped operator tokens, and show a clear operator.read fallback message when a connection really lacks read scope, so operator sessions stop failing or blanking on read-backed pages. (#53110) Thanks @BunsDev.
• Plugins/ClawHub: resolve plugin API compatibility against the active runtime version at install time, and add regression coverage for current >=2026.3.22 ClawHub package checks so installs no longer fail behind the stale 1.2.0 constant. (#53157) Thanks @futhgar.
• Plugins/uninstall: accept installed clawhub: specs and versionless ClawHub package names as uninstall targets, so openclaw plugins uninstall clawhub:<package> works again even when the recorded install was pinned to a version.
• Browser/Chrome MCP: wait for existing-session browser tabs to become usable after attach instead of treating the initial Chrome MCP handshake as ready, which reduces user-profile timeouts and repeated consent churn on macOS Chrome attach flows. Fixes vhrahulkumar/openclaw-appplat...

• Fixes ⚠️ OpenClaw 2026.3.11 upgrade failed automated tests #20

---

⌨️ Start Copilot coding agent tasks without leaving your editor — available in VS Code, Visual Studio, JetBrains IDEs and Eclipse.