refactor: consolidate coercion contracts (#122458)

* refactor: consolidate coercion contracts

Centralize exact string, record, numeric, date, Boolean, argument, and structured-error coercions while preserving call-site semantics.

Migrate canonical-name collisions and deprecated internal SDK bypasses, deleting 55 net production/tooling lines. Expand declaration ownership enforcement to 101 allowed helpers and add a narrow export-completeness audit.

* fix: preserve standalone script coercions

Keep copied Control UI tooling self-contained and retain the trusted release harness module-relative source seam when the harness runs against an old target cwd.

extensions/github-copilot/auth.test.ts

@@ -7,13 +7,15 @@ const coerceSecretRefMock = vi.hoisted(() => vi.fn());
 const resolveConfiguredSecretInputWithFallbackMock = vi.hoisted(() => vi.fn());
 const resolveRequiredConfiguredSecretRefInputStringMock = vi.hoisted(() => vi.fn());
 
-vi.mock("openclaw/plugin-sdk/provider-auth", () => ({
-  coerceSecretRef: coerceSecretRefMock,
-  ensureAuthProfileStore: ensureAuthProfileStoreMock,
-  listProfilesForProvider: listProfilesForProviderMock,
-  normalizeOptionalSecretInput: (value: unknown) =>
-    typeof value === "string" && value.trim() ? value.trim() : undefined,
-}));
+vi.mock("openclaw/plugin-sdk/provider-auth", async () => {
+  const { normalizeOptionalString } = await import("openclaw/plugin-sdk/string-coerce-runtime");
+  return {
+    coerceSecretRef: coerceSecretRefMock,
+    ensureAuthProfileStore: ensureAuthProfileStoreMock,
+    listProfilesForProvider: listProfilesForProviderMock,
+    normalizeOptionalSecretInput: normalizeOptionalString,
+  };
+});
 
 vi.mock("openclaw/plugin-sdk/secret-input-runtime", () => ({
   resolveConfiguredSecretInputWithFallback: resolveConfiguredSecretInputWithFallbackMock,