feat(docs): Add Agentic OS deployment solution for OpenClaw

[kongche-jbw]

Description

This PR aligns OpenClaw integration docs and execution guidance with the current repository layout, and improves installer UX and observability for install, rollback, and status workflows.

Main updates include:

• Unified command and path references to the current extension/openclaw structure in documentation and skill guidance.
• Improved module output readability with clearer separators during install and rollback.
• Added per-module real executed shell command reporting in install and rollback reports.
• Improved list and status table alignment for mixed Chinese/English output.
• Fixed rollback status persistence so full rollback no longer causes unknown status display.
• Enhanced status output to include real-time detection fallback and clearer human-readable state mapping.

Related Issue

no-issue: repository structure alignment, documentation maintenance, and installer UX/status consistency improvements

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional change)
• Performance improvement
• CI/CD or build changes

Scope

• cosh (copilot-shell)
• sec-core (agent-sec-core)
• skill (os-skills)
• sight (agentsight)
• tokenless (tokenless)
• Multiple / Project-wide

Checklist

• I have read the Contributing Guide
• My code follows the project's code style
• I have added tests that prove my fix is effective or that my feature works
• I have updated the documentation accordingly
• For cosh: Lint passes, type check passes, and tests pass
• For sec-core (Rust): cargo clippy -- -D warnings and cargo fmt --check pass
• For sec-core (Python): Ruff format and pytest pass
• For skill: Skill directory structure is valid and shell scripts pass syntax check
• For sight: cargo clippy -- -D warnings and cargo fmt --check pass
• For tokenless: cargo clippy -- -D warnings and cargo fmt --check pass
• Lock files are up to date (package-lock.json / Cargo.lock)

Testing

Manual validation performed:

• bash -n agenticos2openclaw.sh
• Verified install plan output readability and per-step separators
• Verified rollback report shows per-module executed shell commands
• Verified status output alignment and state mapping behavior
• Verified full rollback no longer leads to unknown module status in report

Additional Notes

This PR intentionally keeps behavior non-breaking while improving operator experience:

• Better command transparency for troubleshooting
• Clearer report readability during long-running operations
• Path consistency between docs, skill instructions, and actual repository layout

[samchu-zsl]

Summary

Solid scope and good hygiene on the script side, but the user-facing path references are inconsistent with the actual directory layout in this PR — every install command in the new docs will 404 / "No such file" once this lands. Marking this as request-changes only on that one issue; the rest is non-blocking.

🔴 Blocker — extension/openclaw/... vs agent-adapter/openclaw/... mismatch

The PR creates agent-adapter/openclaw/{README.md, SKILL.md, agenticos2openclaw.sh}, but the docs inside reference a different path:

• agent-adapter/openclaw/README.md — 9 references to extension/openclaw/...
• agent-adapter/openclaw/SKILL.md — 12 references to extension/openclaw/...
• git ls-tree pr-450 confirms only agent-adapter/openclaw/ is created; there is no extension/openclaw/ directory anywhere on the PR HEAD.

Concrete consequences after merge:

1. curl -fsSL https://raw.githubusercontent.com/alibaba/anolisa/main/extension/openclaw/agenticos2openclaw.sh | bash -s -- --mode recommended → HTTP 404 (this URL appears 6× across README + SKILL).
2. bash extension/openclaw/agenticos2openclaw.sh --mode recommended (and --list, --status, --rollback, --retry, --dry-run variants) → No such file or directory (15× across README + SKILL).
3. The PR description even calls out "Unified command and path references to the current extension/openclaw structure", but the actual directory does not match the structure described.

Pick one direction before merge:

• Option A — rename the new directory to extension/openclaw/ so the docs and the GitHub raw URL match. This is the simpler fix if extension/ is the intended layout going forward.
• Option B — keep the directory at agent-adapter/openclaw/ and rewrite all 21 doc references (find/replace extension/openclaw/ → agent-adapter/openclaw/).

Either is fine; the constraint is that the path the docs name and the path the file actually lives at must agree.

Verification done during review

• set -euo pipefail, Bash-4 guard, and printf '%q' shell-quoting in run_cmd handle the basic injection surface; the script does not use eval, curl|bash, wget|sh, or os.system-equivalent shells.
• rm -rf paths are all derived from controlled bases: dest_dir = $OPENCLAW_SKILLS_DIR, skill_name = basename(...) (no .. / / slip), ext_dir = $OPENCLAW_HOME/extensions/<const>.
• JSON state file writes use mktemp + jq + jq empty validation + mv — atomic and corruption-resistant.
• The Python script configure_openclaw_dingtalk.py uses only argparse + json + pathlib.Path; no subprocess, os.system, eval, or exec. It has a proper if __name__ == "__main__": guard.
• install-openclaw/SKILL.md internal links (references/troubleshooting.md, references/dingtalk-setup-guide.md, scripts/configure_openclaw_dingtalk.py) all resolve on PR HEAD, and the openclaw@v2026.4.26 version reference is consistent across the description, phase headers, and install commands.

🟡 Minor (not blocking, would be nice to address in this round)

1. Commit scope is misleading. The headline feat(docs): add agentic os deployment skill for openclaw understates the change — the diff includes 2064 lines of new shell script and 304/-154 lines of Python. Per AGENT.md's scope-by-path table, src/os-skills/ maps to skill; new agent-adapter/ isn't in the table at all. Consider feat(skill): or splitting the commit, given that CI rejects missing scope.
2. Type of Change checkboxes are mutually contradictory. Bug fix + New feature + Refactoring (no functional change) are all checked. The PR is functionally a new feature (new directory, new installer, expanded skill); the other two should be unchecked to keep the form honest.

ℹ️ Info (optional)

3. Non-interactive default in main() is a footgun. No-args + non-TTY → script auto-resolves recommended modules and starts installing without confirmation. A cron job or piped invocation could trigger an unwanted install. Prefer requiring an explicit --mode flag in the no-TTY path.
4. state_get_module interpolates $name directly into the jq path (json_read "$STATE_FILE" ".modules[\"$name\"].$field"). Today every name is a script-internal constant, so there's no injection in practice, but the rest of the file uses --arg / --argjson consistently — keeping that convention here would protect the next contributor.
5. SKILL.md frontmatter conventions diverge across the PR. This PR shrinks install-openclaw/SKILL.md from 5 fields (with version/layer/lifecycle) to 2, while agent-adapter/openclaw/SKILL.md keeps the 5-field form. The repo as a whole already has 3 different frontmatter styles across 5 os-skills/ai/*/SKILL.md files, so this is more a maintainer-level "pick a schema and document it" question than a per-PR fix; flagging here so it doesn't get lost.

Once the path mismatch is resolved, the rest looks fine — the script and the Python helper are well-structured, the rollback / retry / status flows are clearly modeled, and the test surface (manual: bash -n, install plan output, rollback report, status alignment) is reasonable for what's effectively a deployment script.

[samchu-zsl]

🔴 Path mismatch — this URL will 404 after merge.

The default for AGENTICOS_INSTALLER_URL points at …/main/extension/openclaw/agenticos2openclaw.sh, but the PR creates the file at agent-adapter/openclaw/agenticos2openclaw.sh. There is no extension/openclaw/ directory anywhere on this PR's HEAD (git ls-tree pr-450 only shows agent-adapter/openclaw/).

Same root cause for the local-repo path on line 24 (bash extension/openclaw/agenticos2openclaw.sh ...) and for ~12 other references throughout this file plus 9 in README.md. Once merged, every install command shown in the docs will fail.

Two ways to fix, pick one:

• Rename the new directory to extension/openclaw/ so the existing URL and bash paths land — simplest if that's the intended layout.
• Keep the directory at agent-adapter/openclaw/ and find/replace extension/openclaw/ → agent-adapter/openclaw/ across this file and README.md (21 spots total).

See the overall review for the full list of affected lines.