v5.0.6

v5.0.6 — OpenClaw process contract + OS-owned policy lock. Guard stays off.

Patch on 5.0.5. Node floor unchanged. Cloud pin stays ^5.0.0.

• OpenClaw native process is a reviewed contract. list/poll/log allow. Stop or type-into still cards in plain English, not invalid_tool_input. Allow-once is this call only.
• OS-owned policy lock: shieldcortex protect (root, once) pins the security-critical config so an agent cannot quietly turn Guard off.

What's Changed

• fix(doctor): leftover ~/.hermes is not a Hermes install by @TARSDrakon in #495
• docs(readme): ShieldCortex is the door, not a second brain by @TARSDrakon in #497
• fix(doctor): leftover ~/.openclaw is not an OpenClaw install by @TARSDrakon in #496
• fix(cli): leftover empty ~/.openclaw is not an allowlist-scan install by @TARSDrakon in #498
• fix(guard): #444 docstring backtick is prose, not a shell-out sink by @TARSDrakon in #499
• feat(guard): #500 gate tool-call mutations to Guard itself by @TARSDrakon in #518
• test(guard): #500 pm-repeat tripwire measures the walk, not the tokeniser by @TARSDrakon in #520
• fix(cli): #502 approve/deny require operator provenance, not just a TTY by @TARSDrakon in #523
• feat(defence): #501 OS-owned policy lock under the security config by @jarvis-drakon in #522
• fix(guard): OpenClaw native process is a reviewed contract by @TARSDrakon in #525
• chore(release): v5.0.6 by @TARSDrakon in #526

Full Changelog: v5.0.5...v5.0.6