Add OpenClaw Dynamo provider plugin

[ishandhanani]

This adds an OpenClaw provider plugin that sends canonical Dynamo session headers for root and native subagent requests. It also adds pinned and floating upstream compatibility gates so OpenClaw, Pi, and Hermes integration drift is caught automatically.

How This Was Implemented

• Register a dynamo provider wrapper for embedded turns and simple completions.
• Map OpenClaw sessionId to x-dynamo-session-id and native child lineage to x-dynamo-parent-session-id.
• Run a real OpenClaw Responses loop with sessions_spawn against 2026.6.8 and latest.
• Test Pi's pinned dependencies and latest packages through type-check, unit test, and build.
• Test Hermes' real plugin loader and AIAgent contract against the validated commit and latest main.
• Run the floating compatibility matrix nightly while retaining Dynamo's CPU mocker ingestion smoke.

Walkthrough

• openclaw-plugin/index.js: provider registration and session-lineage lookup.
• openclaw-plugin/headers.js: case-insensitive canonical header injection.
• openclaw-plugin/test/runtime-smoke.mjs: deterministic local Responses server driving a real root and child turn.
• hermes-plugin/tests/upstream_smoke.py: real upstream class and method contract check.
• .github/workflows/integration-smoke.yml: fast contracts, fixed/latest matrices, nightly schedule, and Dynamo ingestion smoke.

Validation

• npm test --prefix openclaw-plugin (4/4 passed).
• OpenClaw runtime smoke passed on 2026.6.8 and latest 2026.6.10: 2 stable root requests and 1 correctly linked child request each.
• Pi check, unit tests, and build passed on pinned 0.72.1 and latest 0.73.1.
• Hermes plugin enable/list and real AIAgent smoke passed on 0.17.0.
• actionlint .github/workflows/integration-smoke.yml and git diff --check passed.
• Live OpenClaw 2026.6.8 against Dynamo agg_agent.sh: 3 root requests plus 1 correctly linked child request.