Tests, providers, and UI drift cleaned across OpenClaw

Slack test coverage lost 500 lines of duplicated client setup and payload expectations, now consolidated into typed case tables without dropping an expanded test case or test name [1]. Provider adapters follow: SGLang and vLLM now share one self-hosted OpenAI-compatible definition, preserving the lazy setup, SGLang replay policy, and vLLM thinking/stream handling that had drifted across the siblings [2].

The Control UI no longer owns copies of security policy and gateway wire types. Sensitive config keys now come from `src/config/sensitive-paths.ts`, closing the gap where credential families were unmasked in browser-rendered tool details and UI declarations could silently diverge from runtime owners [3].

Two smaller fixes land in transport behavior. Codex session streams now accept their lifecycle-owned runtime binding when wrapper identity differs, preserving native WebSocket behavior while still rejecting unrelated custom streams [4]. Telegram stops retrying permanent media-file lookup failures, using the canonical classifier and a tightly scoped grammY exception so temporary-file-unavailable responses still succeed on retry [5].

Docs tooling syncs with Carapace 0.6.1, which promotes neutral theme roles to OKLCH; Mermaid 11's parser rejects OKLCH, so the fix normalizes CSS Color 4 values before handing them to the legacy parser, preventing silently broken diagrams [6].