Fix Brev development secure links and gateway restart

[liveaverage]

Changes

• Correct current Brev secure-link origins and configured gateway startup.
• Target stable OpenClaw v2026.9.9 and install a supported Node 24 LTS runtime.
• Preserve private config backups and apply safe upstream Doctor migrations.
• Support narrowly configured reverse-proxy IP attribution while retaining token authentication.
• Preserve SecretRefs and generate official temporary dashboard links with the correct external WebSocket target.
• Pass an allowlist of non-secret bootstrap settings into the first-run code-server terminal; do not embed API keys or gateway tokens in that generated command.
• Add 45 regression cases and an automated CI workflow.

Validation

• Reproduced the original disallowed-origin/obsolete URL failures on the Development Launchable.
• Checked upstream v2026.9.9 release validation, npm preflight, package integrity, and published provenance evidence.
• Earlier migrated-state and fresh-state tests passed on the original review VM.
• Subsequently deployed a clean OS/VM from the updated Development Launchable, verified no previous OpenClaw config, and completed first-run onboarding through the Google Chrome code-server terminal.
• Fresh Development browser and gateway CLI inference passed using NVIDIA Nemotron 3 Super. Config validation, private credential storage, invalid-token rejection, and untrusted-forwarded-header rejection passed.
• Committed bootstrap rerun/restart and subsequent Development inference passed.
• After Development passed, updated the production OpenClaw Launchable with explicit user authorization and verified persisted settings without changing hardware/access settings.
• Deployed a separate clean production VM from that production Launchable. Fresh Chrome onboarding, live browser/gateway CLI inference, config validation, and authentication negative tests passed.
• Production bootstrap restart completed with exit 0. Both post-restart browser and CLI inference passed with the expected NVIDIA model; invalid-token/forwarded-header negative checks still passed. Anonymous access to both secure links returned HTTP 302.
• Both deployments verified clean source commit c1eea518ed91575f72842aa0b0fcf6f07276b5e0, OpenClaw 2026.9.9, and Node v24.21.0.
• All 45 regression cases and final push CI / PR CI passed.

Scope and operational notes

• Squash-merged with user authorization at 7974a63170dceae63877b020112db3b4f6cebfe9; merged runtime/regression files match the tested head. Post-merge main CI passed.
• Production and Development Launchable bootstrap URLs now pin the squash commit and configure LAUNCH_REPO_REF="main". Reopened both Launchables to verify persisted values; no fix-branch dependency remains. Configuration source still follows mutable main.
• Updated the retained production checkout to merged main and reran bootstrap successfully. Post-merge NVIDIA inference passed through the gateway CLI and Chrome Control UI, with the expected model and no CLI fallback/tools.
• Observed proxy IP 100.73.87.46 matched actual ingress on both fresh deployments. It is route-specific, not a universal Brev address. No wildcard/overlay-network trust or authentication bypass was added.
• Deleted the original review VM and both Development trial VMs. Left only the validated production VM running at approximately $0.19/hour, as requested. Teammate instances were not modified.
• During the earlier March-state migration, a stale lock was verified to reference a stopped process and preserved in the rollback backup. No automatic lock deletion or forced service repair was introduced.
• VM reboot recovery, other providers, messaging integrations, optional native/plugin functionality, and comprehensive security qualification remain out of scope. npm restricted install-hook warnings did not prevent the tested core paths.
• README examples still contain legacy URLs/version references; users should use the actual connection link printed by the configuration terminal.