…e (NUIA phase 4) (openclaw#105132)

* fix(extensions): make indexed access explicit across channel plugins

Transport-payload-safe burn-down: malformed Telegram/Discord/QQ/LINE
and sibling channel input keeps existing skip paths; no synthesized
fields, no new throws in delivery loops. Zalo escape sentinels preserve
literal matches instead of undefined replacements.

* fix(extensions): make indexed access explicit across provider and memory plugins

Stream and model iteration, tool-block guards, capture guards, and
sparse accumulators; singleton model reads carry named invariants.

* fix(extensions): make indexed access explicit across tooling plugins, flip the extensions lane

Remaining plugins (oc-path, qa-lab, browser, logbook, and siblings) plus
the tsconfig.extensions.json flag flip. Cleanup: logbook sampleFrames
NaN index at max=1, QA retry clamp at non-positive attempts, dead Canvas
probe and OpenShell no-op slice removed, twitch test setup leak excluded
from the prod lane.

* refactor(plugin-sdk): expose expectDefined via a focused SDK subpath

Extensions imported @openclaw/normalization-core directly, crossing the
external-plugin packaging boundary (it only worked because the runtime
builder bundles undeclared workspace helpers). expect-runtime joins the
canonical entrypoints JSON, generated exports, API baseline, docs, and
subpath contract test; all 78 extension imports now use the SDK seam.
Two scanner-shaped locals renamed for review-bundle hygiene.

* chore(plugin-sdk): raise surface budgets for the expect-runtime subpath

One new entrypoint with one callable export, added intentionally as the
packaging-honest seam for extension invariant helpers.

…hreadDirectMessages

The 7.2 cherry-pick resolved extensions/mattermost/src/mattermost/monitor.ts by
taking our side wholesale, silently reverting six upstream commits landed between
7.1 and 7.2. Adopt them instead of clobbering:

  f77c2aa  truncate the inbound preview on a code-point boundary (openclaw#101630)
  b7ab62c  preserve text-block boundaries in the draft preview (openclaw#87449)
  da6a24d  prevent hung pre-delivery hooks from blocking lanes (openclaw#104256)
  218dcd8  noUncheckedIndexedAccess in the extensions lane (openclaw#105132)
  9cdf166  trim the monitor gating facade (openclaw#106021)

70a7e6e (opt-in DM threading by chat type) was already in the impl; three 7.1-era
assertions in monitor.test.ts that upstream had superseded move to upstream's
semantics (the implementations are byte-identical to upstream).

b7ab62c's 173-line monitor hunk (block-preview boundary machinery) was hand-ported
onto our activity/warm-fallback interleaving; the block-preview code is now
byte-identical to pristine 7.2.

threadDirectMessages kept as a thin compat feeding upstream's replyToModeByChatType,
because Dockerfile.base's shared config probe still writes it and the probe spans
matrix bases older than 2026.7.2. Retire both together later.

Mattermost suite 630/632. The 2 remaining timeouts are localized to
deliverMattermostReplyWithDraftPreview: with a mocked-rejecting updateMattermostPost,
our patched buildFinalEdit attempts the in-place edit (pristine skips it), the edit
rejects, and the deliverNormally fallback awaits the unmocked deliverMattermostReplyPayload
which never resolves under the test's bare sendMessageMattermost stub. Behavioral
divergence in our activity/warm-fallback finalize path, not the upstream port. TODO.