docs: sync with goclaw source changes c5bfbc96..c083622f (EN+VI+ZH)

[thieung]

Summary

• Sync 16 doc pages (48 files across EN/VI/ZH) with goclaw source changes c5bfbc96..c083622f
• All goclaw-source metadata updated to c083622f / 2026-04-05
• 3 accuracy discrepancies discovered and fixed during verification

Changes by Priority

P1 — High (5 pages)

• reference/database-schema — migration 036: secure_cli_agent_grants table, is_global on secure_cli_binaries
• agents/system-prompt-anatomy — section count 19+ → 23, added Credentialed CLI + 3 other missing sections
• deployment/upgrading — added migration 036 entry
• advanced/cli-credentials — replaced stub with full per-agent grants docs (model, REST API, patterns)
• providers/openai — added reasoning_defaults, override_mode, GPT-5/Codex effort normalization

P2 — Medium (6 items)

• providers/overview — BytePlus Seedream/Seedance, Codex OAuth pool routing strategies
• core-concepts/tools-overview — BytePlus media tools in inventory
• channels/slack — mention dedup behavior when require_mention: false
• advanced/exec-approval — 15 shell deny groups + per-agent override config
• reference/rest-api — CLI credential agent grants CRUD endpoints
• reference/websocket-protocol — VI/ZH sync (was 2 days behind EN)

P3 — Verified & Fixed (5 pages)

• advanced/skills — fix: 5-tier → 6-tier hierarchy with correct source labels
• advanced/api-keys-rbac — fix: no-auth mode grants RoleAdmin not RoleOperator
• reference/config-reference — fix: pending_compaction defaults 50/15 → 200/40
• deployment/security-hardening — accurate, SHA bump only
• advanced/sandbox — accurate, SHA bump only

Test plan

• Verify all 47 modified files render correctly in docs site
• Spot-check EN/VI/ZH consistency on 2-3 pages
• Confirm goclaw-source footer shows c083622f on all updated pages