fix(install): avoid success after incomplete lifecycle changes (#125992)

* fix(install): make lifecycle mutations transactional

Standalone installers now apply npm-version-aware lifecycle approval. Updates verify and repair the installation before reporting success and preserve the prior install owner during method switches. Uninstall now exits nonzero when requested cleanup is only partially completed. Plugin update behavior is unchanged.

Closes #125925

* test(uninstall): assert aggregated live-owner failure

* fix(install): satisfy standalone shell checks

* fix(update): scan PATH for prior Git wrapper

* test(hooks): await Gmail watcher descendant exit

* fix(install): verify Windows npm candidate

* fix(ci): normalize package acceptance version

* fix(update): preserve staged local package links

* test(update): fold staged symlink coverage

* fix(update): retire every legacy Git wrapper

* test(docs): align consolidated ownership checks

.github/workflows/package-acceptance.yml

@@ -811,6 +811,65 @@ jobs:
           }
           node scripts/check-openclaw-package-tarball.mjs "$package"
 
+  npm_12_install_sh:
+    name: npm 12 install.sh acceptance
+    needs: [resolve_package, package_integrity]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - name: Checkout package workflow ref
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ inputs.workflow_ref }}
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Setup Node 24
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+
+      - name: Download package-under-test artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          artifact-ids: ${{ needs.resolve_package.outputs.package_artifact_id }}
+          path: .artifacts/docker-e2e-package
+          run-id: ${{ needs.resolve_package.outputs.package_artifact_run_id }}
+          github-token: ${{ github.token }}
+
+      - name: Run install.sh with npm 12
+        env:
+          EXPECTED_PACKAGE_SHA256: ${{ needs.resolve_package.outputs.package_sha256 }}
+          EXPECTED_PACKAGE_VERSION: ${{ needs.resolve_package.outputs.package_version }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          package="$PWD/.artifacts/docker-e2e-package/openclaw-current.tgz"
+          [[ "$(sha256sum "$package" | awk '{print $1}')" == "$EXPECTED_PACKAGE_SHA256" ]]
+          npm_tool="$RUNNER_TEMP/openclaw-npm12-tool"
+          install_home="$RUNNER_TEMP/openclaw-npm12-home"
+          install_prefix="$RUNNER_TEMP/openclaw-npm12-prefix"
+          mkdir -p "$install_home" "$install_prefix"
+          npm install -g --prefix "$npm_tool" npm@12.0.2
+          export PATH="$npm_tool/bin:$install_prefix/bin:$PATH"
+          [[ "$(npm --version)" == "12.0.2" ]]
+          HOME="$install_home" \
+            NPM_CONFIG_CACHE="$RUNNER_TEMP/openclaw-npm12-cache" \
+            NPM_CONFIG_PREFIX="$install_prefix" \
+            OPENCLAW_VERSION="$package" \
+            bash scripts/install.sh --install-method npm --no-prompt --no-onboard
+          source scripts/docker/install-sh-common/version-parse.sh
+          installed_version="$(extract_openclaw_semver "$("$install_prefix/bin/openclaw" --version)")"
+          [[ "$installed_version" == "$EXPECTED_PACKAGE_VERSION" ]] || {
+            echo "Installed OpenClaw version $installed_version differs from expected $EXPECTED_PACKAGE_VERSION." >&2
+            exit 1
+          }
+          guard="$install_prefix/lib/node_modules/openclaw/dist/openclaw-install-guard"
+          [[ ! -e "$guard" ]]
+
   docker_acceptance:
     name: Docker product acceptance (artifact-only)
     needs: [resolve_package, package_integrity]
@@ -951,6 +1010,7 @@ jobs:
       [
         resolve_package,
         package_integrity,
+        npm_12_install_sh,
         docker_acceptance,
         docker_acceptance_registry,
         package_telegram,
@@ -965,6 +1025,7 @@ jobs:
           DOCKER_ARTIFACT_RESULT: ${{ needs.docker_acceptance.result }}
           DOCKER_REGISTRY_RESULT: ${{ needs.docker_acceptance_registry.result }}
           PACKAGE_INTEGRITY_RESULT: ${{ needs.package_integrity.result }}
+          NPM_12_INSTALL_RESULT: ${{ needs.npm_12_install_sh.result }}
           PACKAGE_TELEGRAM_RESULT: ${{ needs.package_telegram.result }}
           RESOLVE_RESULT: ${{ needs.resolve_package.result }}
           TELEGRAM_ENABLED: ${{ needs.resolve_package.outputs.telegram_enabled }}
@@ -988,6 +1049,7 @@ jobs:
           for item in \
             "resolve_package=${RESOLVE_RESULT}" \
             "package_integrity=${PACKAGE_INTEGRITY_RESULT}" \
+            "npm_12_install_sh=${NPM_12_INSTALL_RESULT}" \
             "docker_acceptance=${docker_result}" \
             "package_telegram=${PACKAGE_TELEGRAM_RESULT}"
           do