Expand safeBinProfiles in config/openclaw.prod.json5 to unblock agent operations. Changes: 1) gh maxPositional 5->12 plus API/issue/PR flags 2) Add curl profile with -s/-X/-H/-d/-o/-w 3) Expand git flags for clone/push 4) Add find allowPathPositionals 5) Add openclaw binary to safeBins. See Piboonsak/Openclaw#159 for full spec. Sprint 2.2a Phase 1.