Bug Description

openclaw doctor suggests removing the active gateway LaunchAgent plist as a "cleanup hint," even when that plist is the currently running gateway service.

Steps to Reproduce

1. Install OpenClaw on macOS with LaunchAgent-managed gateway (standard setup)
2. Run openclaw doctor
3. Observe output includes:

◇  Cleanup hints
│  - launchctl bootout gui/$UID/ai.openclaw.gateway
│  - rm ~/Library/LaunchAgents/ai.openclaw.gateway.plist

4. Following these hints kills the running gateway

Expected Behavior

Doctor should detect that ai.openclaw.gateway is the active gateway service (via launchctl list or PID check) and NOT suggest removing it. The cleanup hint should only appear for genuinely orphaned/stale plists.

Actual Behavior

Doctor always suggests removing the plist, even when it is the live service keeping the gateway running. Following the hint causes downtime until the plist is recreated and the service reloaded.

Additional Issue: SecretRef exit code

openclaw doctor also exits with code 1 when it encounters exec:keychain: SecretRef values in the config:

Error: channels.telegram.botToken: unresolved SecretRef "exec:keychain:telegram-bot:KnoxyTheSecondBot".
Resolve this command against an active gateway runtime snapshot before reading it.

This is expected behavior - keychain secrets are resolved at gateway runtime, not by the doctor CLI. Doctor should either:

• Skip SecretRef validation for exec: sources, or
• Attempt resolution and treat failure as a warning (not an error/non-zero exit)

Environment

• OpenClaw: 2026.3.13
• macOS: 26.3.1 (Apple Silicon)
• Service management: launchd (LaunchAgent)