Follow-up to #76693 (Node-side credential masking).

Problem

After #76693 lands, the wizard backend emits WizardStep.sensitive: true on every credential text prompt (Gemini/OpenAI/etc. provider keys, gateway tokens and passwords, web-search provider keys, skill env-var values). The Node CLI client (clack adapter) honors that flag via @clack/prompts.password(). The SwiftUI macOS app already honors it via SecureField (apps/macos/Sources/OpenClaw/OnboardingWizard.swift:303).

The bundled openclaw-mac wizard CLI (apps/macos/Sources/OpenClawMacCLI/WizardCommand.swift:445) does not honor step.sensitive. It reads every text step with readLineWithPrompt, which echoes input and prints [initial] if an initial value is set. Result: users running the macOS CLI wizard against a gateway will still see API keys / gateway tokens / passwords in their terminal scrollback.

This is the residual leak path acknowledged in #76693's body under "Out-of-scope leak path (acknowledged)".

What needs to change

In apps/macos/Sources/OpenClawMacCLI/WizardCommand.swift, the case "text": branch of promptAnswer(for:) should:

1. Check step.sensitive == true.
2. When set, dispatch to a no-echo reader (POSIX termios c_lflag & ~ECHO, NOT getpass(3) — _PASSWORD_LEN truncates at 128 chars on BSD/macOS, which silently drops longer credentials like JWTs / OpenRouter keys).
3. Suppress the bracketed [initial] value display for sensitive steps.

The WizardStep.sensitive field is already decoded by apps/macos/Sources/OpenClawProtocol/GatewayModels.swift:2402; no protocol change required.

Acceptance criteria (from clawsweeper review on #76693)

• swiftlint --config .swiftlint.yml clean
• swiftformat --lint apps/macos/Sources --config .swiftformat clean
• swift build --package-path apps/macos --product OpenClaw --configuration release succeeds
• Manual or scripted proof that a sensitive wizard text step accepts a credential longer than 128 characters without echo or truncation

Why I'm not doing this in #76693

I authored #76693 on a Windows host with no Apple toolchain. Three speculative iterations of this Swift change shipped through CI on the prior PR (#76615, now closed) and all failed; rather than keep guessing, I scoped #76693 to the Node side and opened this issue so a contributor with macOS access can land it cleanly in a focused PR.

References

• clawsweeper review on fix(onboarding): mask token/credential inputs in CLI wizard prompts #76693 flagging this exact gap (P2 finding)
• "Out-of-scope leak path (acknowledged)" subsection in fix(onboarding): mask token/credential inputs in CLI wizard prompts #76693's body
• Pattern reference: SwiftUI SecureField in apps/macos/Sources/OpenClaw/OnboardingWizard.swift:303