Describe the bug

Running openclaw doctor --fix on macOS rewrites the LaunchAgent plist file, dropping all EnvironmentVariables entries that the doctor command doesn't explicitly manage.

This is destructive because the plist EnvironmentVariables dict is the canonical way to pass secrets (API keys, tokens) to the gateway process on macOS. Users with custom env vars lose them silently.

To reproduce

1. Have a working LaunchAgent plist with user-defined env vars:

<key>EnvironmentVariables</key>
<dict>
    <key>OLLAMA_API_KEY</key>
    <string>ollama</string>
    <key>MY_CUSTOM_TOKEN</key>
    <string>secret</string>
</dict>

2. Run:

openclaw doctor --fix --yes

3. The plist is rewritten. Only OpenClaw-managed keys survive; user-added keys are gone.

Expected behavior

doctor --fix should either:

• Preserve unknown keys in the EnvironmentVariables dict (merge, don't replace)
• Not rewrite the plist if the only changes are to openclaw.json
• Warn and skip if it detects env vars it doesn't manage, rather than silently dropping them

Impact

• Gateway fails to start because secrets referenced via ${VAR_NAME} in openclaw.json are missing from the environment
• The error message ("required secrets are unavailable") doesn't indicate that doctor caused the problem
• Users with backups can restore, but running a "fix" command that breaks the setup is a confusing failure mode

Environment

• OS: macOS 15.4 (Darwin 25.2.0, arm64)
• Node: v25.5.0
• OpenClaw: v2026.3.12 (also reproduced on v2026.3.11)
• Install method: npm global

Additional context

Reproducible on every version from v2026.3.8 through v2026.3.12. The current workaround is to back up the plist before running doctor --fix and restore afterward.