fix(openclaw): roll back to 2026.4.22 fat — escape v4.25 NFS+SQLite hang

[prez2307]

Summary

• Pin openclaw-version.json to alpine/openclaw:2026.4.22 (fat variant). Drops -slim.
• Add three schema-required fields to agents.defaults (embeddedHarness, contextLimits, heartbeat) — required by v2026.4.22 zod schema.
• Re-enable channel plugins (telegram, discord, slack → enabled: true); the disable was a v4.25-specific defensive patch.

Why

v2026.4.25-slim deterministically wedges every container start. From a live ECS-exec probe on the running gateway:

PID 52 (openclaw-gateway):
  State: D (uninterruptible disk sleep)
  wchan: rpc_wait_bit_killable
  fds:   /home/node/.openclaw/tasks/runs.sqlite{,-wal,-shm}
  mount: 127.0.0.1:/  /home/node/.openclaw  nfs4  hard,port=21005

Matches upstream issue #73517 — task-registry hot-loop on stale runs.sqlite (reported against the same commit aa36ee6). Loopback NFS server inside the openclaw container deadlocks the gateway's main JS thread.

Forward path is blocked too: v2026.4.26 has an unfixed acpx-EPERM regression on remote filesystems (#73333, fix PR #73341 closed but not merged).

So the only safe move is back. We previously ran on 2026.4.22 fat in #406 with no hang. Fat variant has all bundled plugin runtime deps prebaked → no 90s install penalty on first boot. Has CODEX_HOME (added 4.7) so ChatGPT OAuth works.

Test plan

• CI builds extended image off 2026.4.22 upstream
• Dev redeploys cleanly
• Provision a fresh container, watch CloudWatch logs reach [gateway] ready and stay healthy past starting channels and sidecars... (the wedge point)
• Backend gateway connection pool establishes WS handshake (no more [ws] closed before connect code=1006)
• ChatGPT-OAuth signup path completes end-to-end

Risk

• New tag 2026.4.22-bootstrap won't resolve until the extended-image CI workflow runs once and pushes a per-commit tag. First deploy after merge will fail; subsequent deploys after the image build are fine.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a861721a1a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Use the literal bootstrap sentinel for unresolved env tags

Setting dev.tag/prod.tag to 2026.4.22-bootstrap bypasses the fallback logic in apps/infra/lib/stacks/container-stack.ts (it only falls back when envTag === "bootstrap"), so deploys will always try to pull an ECR tag immediately. In the same repo, .github/workflows/build-openclaw-image.yml publishes tags as ${UPSTREAM}-${SHORT_SHA}, so CI never creates 2026.4.22-bootstrap; this leaves dev/prod pointing at a tag that is not produced by automation and causes task start failures when that image is selected.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Keep upstream version pin aligned with Dockerfile FROM

This changes the declared upstream pin to alpine/openclaw:2026.4.22, but apps/infra/openclaw/Dockerfile still bases the extended image on alpine/openclaw:2026.4.25-slim (FROM line 63). Because build-openclaw-image.yml derives the pushed tag name from openclaw-version.json.upstream, newly built extended images will be labeled as 2026.4.22-* while still containing the 2026.4.25-slim base, so the rollback is not actually applied on the extended-image path.

Useful? React with 👍 / 👎.