refactor: remove expired plugin compatibility surfaces (#111451)

* docs(secrets): remove retired web credential paths

* refactor(web): remove retired provider compatibility paths

* refactor(providers): delete retired compatibility routes

* refactor(secrets): remove retired credential aliases

* refactor(plugin-sdk): delete retired compatibility surfaces

* docs(plugin-sdk): remove retired migration guidance

* chore(plugin-sdk): refresh rebased surface budgets

* chore(plugin-sdk): refresh API removal baseline

* refactor(compat): migrate retired internal callers

* chore(plugin-sdk): refresh current-main baselines

* test(config): migrate plugin-owned secret assertions

* test(gateway): narrow plugin secret refs

* fix(plugin-sdk): preserve private boundary type identity

* chore(compat): remove stale sweep references

* chore(lint): lower max-lines budget

* refactor(secrets): remove unused web helper

* build(plugin-sdk): drop removed compat entries

* chore(plugin-sdk): refresh rebased API baseline

* chore(plugin-sdk): use Linux API baseline hash

* fix(plugin-sdk): preserve private bundled build entries

* fix(plugin-sdk): package private runtime facades

* fix(plugins): preserve external credential contracts

src/cli/plugins-update-command.ts

@@ -15,7 +15,6 @@ import type { ConfigWriteOptions } from "../config/io.js";
 import { createMergePatch } from "../config/io.write-prepare.js";
 import { applyMergePatch } from "../config/merge-patch.js";
 import { ConfigMutationConflictError } from "../config/mutate.js";
-import { extractShippedPluginInstallConfigRecords } from "../config/plugin-install-config-migration.js";
 import type { OpenClawConfig } from "../config/types.openclaw.js";
 import type { PluginInstallRecord } from "../config/types.plugins.js";
 import { updateNpmInstalledHookPacks } from "../hooks/update.js";
@@ -201,18 +200,8 @@ export async function runPluginUpdateCommand(params: {
   // mutation-start snapshot so concurrent config changes cannot be resurrected.
   const cfg = mutationSnapshot?.snapshot.runtimeConfig ?? getRuntimeConfig();
   const sourceCfg = mutationSnapshot?.snapshot.sourceConfig ?? cfg;
-  const shippedPluginInstallRecords = mutationSnapshot
-    ? {
-        ...extractShippedPluginInstallConfigRecords(mutationSnapshot.snapshot.parsed),
-        ...extractShippedPluginInstallConfigRecords(mutationSnapshot.snapshot.sourceConfig),
-      }
-    : extractShippedPluginInstallConfigRecords(cfg);
   const persistedPluginInstallRecords = await loadInstalledPluginIndexInstallRecords();
-  // Persisted index records win over shipped legacy config during migration.
-  const pluginInstallRecords = {
-    ...shippedPluginInstallRecords,
-    ...persistedPluginInstallRecords,
-  };
+  const pluginInstallRecords = persistedPluginInstallRecords;
   const cfgWithPluginInstallRecords = withPluginInstallRecords(cfg, pluginInstallRecords);
   const sourceCfgWithPluginInstallRecords = withPluginInstallRecords(
     sourceCfg,
@@ -272,13 +261,6 @@ export async function runPluginUpdateCommand(params: {
       snapshotPath: mutationSnapshot.snapshot.path,
       writeOptions: mutationSnapshot.writeOptions,
     });
-    // Write snapshots retain valid shipped install records in sourceConfig after
-    // include resolution; parsed also catches root-authored legacy records.
-    const pluginRecordCleanupMayMutate =
-      Object.keys(extractShippedPluginInstallConfigRecords(mutationSnapshot.snapshot.sourceConfig))
-        .length > 0 ||
-      Object.keys(extractShippedPluginInstallConfigRecords(mutationSnapshot.snapshot.parsed))
-        .length > 0;
     const parsedConfig =
       mutationSnapshot.snapshot.parsed &&
       typeof mutationSnapshot.snapshot.parsed === "object" &&
@@ -299,9 +281,9 @@ export async function runPluginUpdateCommand(params: {
           pluginConfigReferencesId(mutationSnapshot.snapshot.sourceConfig, pluginId))
       );
     });
-    // Manual update records stay in the index unless shipped-record cleanup or
-    // scoped-package compatibility migrates authored references from a legacy id.
-    const pluginConfigMayMutate = pluginRecordCleanupMayMutate || pluginIdMigrationMayMutate;
+    // Manual update records stay in the index unless scoped-package compatibility
+    // migrates authored references from a legacy id.
+    const pluginConfigMayMutate = pluginIdMigrationMayMutate;
     const blockedReasons = new Set<string>();
     if (pluginConfigMayMutate && pluginMutation.mode === "blocked") {
       blockedReasons.add(pluginMutation.reason);