fix(claude-bridge): recover login-shell PATH for bare CLI launches

[artemgetmann]

Review Fast Path

• User path fixed: consumer isolated/launchd-style runtimes can find and launch bare claude again even when the inherited PATH is only system bins.
• Proof: pnpm exec vitest run src/agents/claude-bridge.test.ts passed 2/2 on the consumer lane; direct stripped-env repro still shows bare claude fails with ENOENT, and the bridge test proves the spawn env now merges login-shell PATH before launch.
• Shared-state footgun removed: consumer claude-bridge no longer assumes the service/runtime PATH already includes user-installed CLI bins like /Users/user/.local/bin.
• Still hurts: this consumer port is intentionally draft-only until the main/runtime fix is validated on an isolated tester Telegram bot/runtime.

Why This Matters

• The runtime PATH/env bug is probably relevant to consumer too, but opening the port does not mean it is ready to merge.
• This keeps the consumer twin prepared without forcing premature rollout before isolated live validation.

Scope Boundary

• Changed: src/agents/claude-bridge.ts, src/agents/claude-bridge.test.ts
• Did not change: consumer startup flow, Telegram transport, continuity/session handling, or service env bootstrap.

Verification

• pnpm exec vitest run src/agents/claude-bridge.test.ts
• Result: 1 passed, 2 passed
• Direct stripped-env repro before fix shape:
  • observed: {"beforeError":{"code":"ENOENT","message":"spawnSync claude ENOENT"},"beforeStatus":null}

AI Assistance

• AI-assisted
• Testing degree: targeted

[artemgetmann]

Isolated tester validation on merged #477 now clears the main PATH/runtime blocker: Telegram runtime ensure ok., runtime_worktree=/Users/user/Programming_Projects/openclaw/.worktrees/claude-runtime-path-fix-main-20260416, runtime_commit=cdf32caf3084434a7246a59221353aea985c55e1, /model claude-bridge/sonnet succeeded, and the follow-up prompt reached Claude upstream before failing on quota (You're out of extra usage...).

Keeping this PR draft for now. That evidence justifies main-line follow-up merges, but it is still main-only validation, not consumer rollout proof. This consumer PATH/runtime port should stay draft until consumer-specific validation justifies rollout.