fix(consumer): type resolved Jarvis runtime tokens

[artemgetmann]

Review Fast Path

• User path fixed: shared runtime build after PR fix(consumer): propagate managed Jarvis backend config #806 can type-check Jarvis resolved token assignments.
• Proof: pnpm build:plugin-sdk:dts passed; focused Jarvis runtime secret test passed.
• Shared-state footgun removed: remote main no longer differs from the break-glass local runtime hotfix needed to restore ai.openclaw.gateway.
• Still hurts: no main-bot Telegram proof yet; coordinator will ask before that.

Why This Matters

PR #806 fixed managed utility propagation but left TypeScript assigning resolved unknown secret values into typed Jarvis token fields. The shared runtime recovery build caught it and refused to reload the default gateway until a local break-glass patch was applied.

Scope Boundary

• Changes only src/secrets/runtime-config-collectors-core.ts.
• Converts already-validated resolved secret values to strings at the assignment boundary.
• Does not change config shape, secret resolution behavior, or runtime ownership scripts.

Verification

• pnpm build:plugin-sdk:dts
• pnpm vitest run --config vitest.unit.config.ts --pool=forks src/secrets/runtime.test.ts -t "resolves Jarvis backend token refs" --maxWorkers 1

AI Assistance

• AI-assisted
• Testing degree: targeted