chore: resolve merge conflicts and fix lint errors

- Add Extended Cognitive State endpoint (openclaw#66)
- Add Create Cognitive Event endpoint (openclaw#67)
- Add Create Affect Signal endpoint (openclaw#68)
- Add Patch Current Intent endpoint (openclaw#69)
- Add Get Explanation Hooks endpoint (openclaw#70)
- Update ToC with AERITH Runtime Wiring section

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Adds env_file directive to docker-compose.prod.yml for flexible environment configuration.

Benefits:
- Load environment variables from .env file (copy from .env.example)
- Easier local development and testing
- Cleaner separation of config from secrets
- Supports agent workspace development iteration

Related to agent self-development capability sprint.

deploy.sh previously only sed-updated the image tag in the VPS compose
file. New volume mounts (env_file, .env:/home/node/.env:ro, gitrepo)
from docker-compose.prod.yml never reached the VPS.

Changes:
- Add scp step to sync docker-compose.prod.yml -> VPS before deploy
- Add chown 1000:1000 for volumes/gitrepo bind-mount target
- Add .env placeholder creation to prevent Docker creating a directory
- Update deploy-vps.yml comment to reflect new sync behavior

style(overlay): update recording overlay theme to pink palette

Resolves contract drift across control UI host/render/gateway wiring and gateway server method typing so core gates return to green.

Refs openclaw#63

Refs openclaw#64

Refs openclaw#65

Refs openclaw#66

Refs openclaw#67

Applies oxfmt normalization to previously drifting docs and a small set of source/test/style files so pnpm check is fully green again.

Refs openclaw#67

openclaw#67)

Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 1.12.0 to 2.2.1.
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](actions/create-github-app-token@d72941d...29824e6)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…law#67)

* fix(slack:PLA-825): allow monitored incident thread follow-ups

* fix(slack:PLA-825): address review findings

* fix(slack:PLA-825): address follow-up review findings

* fix(slack:PLA-825): tighten thread follow-up ingress guard

* fix: clarify slack incident follow-up guards

* fix: rename slack incident follow-up bypass param

* refactor: clarify slack incident follow-up intent

* refactor(slack): clarify incident follow-up gates

* fix(slack): cover incident follow-up review gaps

* fix: preserve slack resolved follow-up filtering

* fix: drop dead slack incident ingress warn path

* refactor: clarify slack resolved-update suppression

* fix(slack): keep resolved follow-up suppression scoped

* fix(slack): audit approved incident follow-ups

* fix: address slack incident follow-up review notes

* fix(slack): allow bot-rooted incident follow-ups

* fix(slack): clarify incident thread follow-up guards

Two related gaps in the CHANGELOG write path both caused PRs to land
in the wrong place:

1) `resolve_merge_changelog_section` only consulted the environment
   override and PR labels. If a PR was only tagged with something
   like `size: S` (no `bug`/`fix`/`feature` label), the default fell
   through to Changes even when the PR title made the category
   obvious (e.g. `fix(cron): clean up deleteAfterRun direct
   deliveries` on PR openclaw#67807). That Conventional-Commits prefix is
   the repo's actual classification signal for most PRs and was
   being ignored.

   Add a title-prefix fallback after the label check: a title
   starting with `fix`, `bugfix`, or `hotfix` (followed by `(`, `:`,
   `!`, or whitespace) routes to Fixes; `feat`, `feature`, `enhance`
   route to Changes. Labels still win when present. Deliberately
   strict so `fixup!`, `fixing ...`, `fixture updates`, `featured
   posts` are not misread as `fix:`/`feat:`.

2) `appendUnreleasedChangelogEntry` deduped only on full-text
   equivalence. When a PR had a detailed entry written during
   prepare and then the merge step called `ensure_pr_changelog_entry`
   again with the short PR-title form, the two text bodies differed
   and the same PR got a duplicate line — that is what happened to
   PR openclaw#67679, which ended up with lines under both `### Changes` and
   `### Fixes`.

   Add a stronger precheck: scan the `## Unreleased` block for any
   existing bullet whose first PR reference matches the new entry's
   PR number. If one exists anywhere in the block (any sub-section),
   skip insertion. Dedup is scoped to Unreleased so the same PR
   number in a released block does not suppress a new Unreleased
   entry, and uses integer-equality on the PR number so `openclaw#67` is
   not shadowed by `openclaw#6767`.

Together these two changes cover both of the recently observed
failure modes:
- Missing section signal from labels (PR openclaw#67807) is now picked up
  from the title.
- Second ensure at merge time (PR openclaw#67679) no longer plants a
  duplicate in a different sub-section.

Covered by shell smoke (27 resolver scenarios) and vitest (12 cases
incl. the openclaw#67679 cross-section regression, released-block false
positive, and PR-number prefix collision).

…SE_URL (#16)

Closes openclaw side of monorepo #67 (ops vault rollout). Removes the
need for a separate SUPABASE_SERVICE_ROLE_KEY in Infisical (which
doesn't exist anyway) — the vault now uses the same `postgres`
connection openclaw already opens for `lp_users` and `syntropy_tokens`.

## Discovery that motivated this

Investigation of Infisical for SUPABASE_SERVICE_ROLE_KEY revealed:

- openclaw's `DATABASE_URL` (Infisical: `/openclaw/DATABASE_URL`)
  already points at Supabase project `vouzkcwwkpqsgiquemwp`.
- SJ's `REFLEX_DB_URL` (Infisical: `/REFLEX_DB_URL`) points at the
  **same project**.
- The ADR-001 framing of "mobile Supabase project as canonical" was
  misaligned with the actual current state — SJ + openclaw already
  share a Supabase Postgres. Mobile is the outlier.
- No SUPABASE_SERVICE_ROLE_KEY exists in Infisical for either project.

The lean architectural move: skip the Supabase JS SDK entirely. Call
the SECURITY DEFINER vault RPCs as plain SQL functions through the
existing pg connection. Same encryption-at-rest guarantee (pgsodium),
fewer moving parts, no new Infisical secrets to provision.

## Changes

### vault.ts — direct SQL executor
- New `SqlExecutor` interface (replaces `RpcCaller`)
- `createSyntropyVault(sql)` factory — wraps `postgres` template tags
  into a narrow scalar/void exec surface
- New `vaultRpcsInstalled(sql)` probe — queries `pg_proc` to detect
  whether the SECURITY DEFINER functions are installed; lets the
  plugin start cleanly in pre-migration / dev environments

### index.ts — startup probe + conditional vault enable
- Drops `createSupabaseVault` import; uses `createSyntropyVault` +
  `vaultRpcsInstalled`
- Vault is enabled iff the probe succeeds at startup. Otherwise the
  plugin falls back to the legacy plaintext `auth_token` column path
  (already in db.ts from openclaw#13) and logs a warn explaining how
  to enable.

### config.ts — drop supabaseUrl / supabaseServiceRoleKey
- ConfigSchema reverted to just `syntropyBaseUrl` + `databaseUrl`
- Removed the production-required Supabase fields (they were never
  going to be provisioned given the actual deployment).
- config.test.ts loses 6 tests that were specific to those fields;
  11 tests remain covering the genuine config surface.

### package.json — drop @supabase/supabase-js
- Removes the dependency entirely from extensions/syntropy.

## What ops still needs to do (monorepo #67, simplified)

The only ops step now: apply
`extensions/syntropy/supabase-migrations/0001_syntropy_vault_rpcs.sql`
to the shared Supabase project `vouzkcwwkpqsgiquemwp`. Methods:

- Supabase Dashboard → SQL Editor → paste + run
- Or `psql $REFLEX_DB_URL -f extensions/syntropy/supabase-migrations/0001_syntropy_vault_rpcs.sql`

Until that's done, openclaw starts in legacy-plaintext mode and logs
a warning at boot. No new env vars, no Infisical key provisioning,
no Fly.io secret sync.

## Verification

  pnpm vitest run extensions/syntropy --config vitest.extensions.config.ts
    → 36/36 tests passing (3 suites — 11 cache + 11 config + 14 vault)

  pnpm tsc --noEmit -p tsconfig.json
    → 0 errors in extensions/syntropy/

  pnpm oxlint --type-aware extensions/syntropy/src/
    → 0 warnings, 0 errors

Refs: monorepo #67 (ops rollout), ADR-001 §4.