Closes #112205
Closes #112206
Closes #112207

What Problem This Solves

Fixes three CLI failure paths that previously reported misleading success or generic failure statuses:

• a foreground Gateway collision printed startup errors but exited 0 when the occupied port answered OpenClaw health checks;
• route-first fast paths for health, status, sessions, and agents list silently ignored unsupported flags;
• respawn wrappers converted children terminated by a forwarded SIGINT/SIGTERM into exit 1 instead of 130/143.

Why This Change Was Made

Gateway duplicate-instance success is now confined to the explicit supervisor-recovery boundary; ordinary foreground lock and port conflicts exit 1. Route-first parsers validate their complete supported argv shape and defer unsupported input to the normal Commander parser. Both launcher implementations preserve the first gracefully forwarded SIGINT/SIGTERM while retaining exit 1 for spawn errors and hard-kill backstops.

The Gateway TLS supervisor probe is non-mutating and retries fingerprint discovery while the lock-owning Gateway finishes certificate generation. Existing bare openclaw agents --json behavior remains supported.

User Impact

Shell scripts and supervisors can now trust the CLI exit status:

• failed foreground Gateway starts are nonzero;
• misspelled or stale flags fail instead of silently using defaults;
• SIGINT/SIGTERM remain distinguishable from ordinary command failure.

Evidence

• AI-assisted change; final uncommitted AutoReview was clean with no accepted/actionable findings.
• Round-two discovery campaign: AWS Crabbox run run_3e83ca8ddd20 executed 1,063 cases across broad CLI grammar, JSON output, config atomicity, completion generation, file inputs, real OpenAI concurrency, two isolated Gateways, 30 in-process restarts, a 600-call read soak, diagnostics, collisions, and resource cleanup. The run directly reproduced all three fixed defects.
• Black-box fixed behavior: AWS Crabbox run run_cb6a78e6864d passed Gateway collision exit 1, all four routed unknown-option failures, retained bare agents --json, and early SIGINT/SIGTERM exits 130/143.
• Focused regression suite after rebase: 205 tests passed, with one platform-gated test skipped.
• Complete changed-scope gate: Blacksmith Testbox tbx_01ky1ssr8fwr4n5racdxa616jp / Actions run 29811216524 passed formatting, script declarations, plugin boundaries, dependency guards, tsgo:all, full core/extensions/scripts lint, storage guards, and import-cycle checks.
• Patched source build: AWS Crabbox run run_516faadc2bd1 passed.
• git diff --check: passed.