merge: refresh Daytona hydration branch from main

* origin/main: (57 commits)
  fix(media): fall back when providers return empty output (#118660)
  fix(nextcloud-talk): allow bounded parallel room deliveries (#118692)
  test(state): reuse current agent database fixture (#118677)
  fix(scripts): bound check-file-utils git lookup (#111582)
  fix(slack): scope interactive conversation bindings safely (#118662)
  fix(agents): avoid false compaction after mid-turn precheck (#117963)
  fix(ui): show original filename on chat history attachment cards instead of managed UUID suffix (#118628)
  fix(whatsapp): preserve terminal retry exhaustion lifecycle (#118659)
  fix(doctor): audit every agent workspace (#111840)
  fix(release): skip unavailable Buzz on frozen candidates (#118670)
  fix(ui): surface onboarding and pairing clipboard failures (#118651)
  fix(config): stop plugin schemas rejecting the channel key core writes (#117992)
  test(memory): isolate wiki plugin fixtures (#118654)
  fix(line): clear default access token when removing account (#118055)
  feat: enable rich setup controls in custodian chat (#114631)
  test(ui): reuse responsive browser fixtures (#118655)
  chore(tui): stabilize queued-turn admission in Gateway PTY test (#118638)
  fix(xai): classify exhausted credits as billing (#118615)
  fix(otel): fail closed when configured TLS material is invalid (#118648)
  fix(cli): preserve gateway request errors in health JSON (#118645)
  ...

.github/workflows/openclaw-release-telegram-qa.yml

@@ -1819,8 +1819,15 @@ jobs:
           sut_tmp="${temp_root}/sut-tmp"
           install -d -o "$SUT_UID" -g "$SUT_GID" -m 0700 "$sut_tmp"
           export TMPDIR="$sut_tmp"
+          workspace="${temp_root}/workspace"
+          [[ -d "$workspace" && ! -L "$workspace" ]]
+          [[ "$(realpath -e "$workspace")" == "$workspace" ]]
+          # The trusted scenario host creates fixtures while the isolated SUT reads
+          # and mutates the workspace. Keep every other runtime directory SUT-private.
+          chown -R "$RUNNER_UID:$SUT_GID" "$workspace"
+          chmod -R u=rwX,g=rwX,o= "$workspace"
+          find "$workspace" -type d -exec chmod g+s {} +
           for path in \
-            "$temp_root/workspace" \
             "${OPENCLAW_HOME:?}" \
             "${OPENCLAW_STATE_DIR:?}" \
             "${XDG_CACHE_HOME:?}" \

.github/workflows/qa-live-transports-convex.yml

@@ -588,7 +588,7 @@ jobs:
           if-no-files-found: error
 
       - name: Require requested Buzz QA runner
-        if: always() && steps.resolve_buzz.outcome == 'success' && steps.resolve_buzz.outputs.available != 'true'
+        if: always() && inputs.expected_sha == '' && steps.resolve_buzz.outcome == 'success' && steps.resolve_buzz.outputs.available != 'true'
         shell: bash
         run: |
           echo "::error::The selected ref does not declare the requested Buzz QA runner."