## Summary

- Bumps OpenClaw from `2026.4.2` to `2026.4.8`
- Updates `OPENCLAW_VERSION` in `Dockerfile.base`,
`min_openclaw_version` in `blueprint.yaml`, `expected_version` in
`agents/openclaw/manifest.yaml`, and test fixtures in
`sandbox-version.test.ts`
- Historical comment in `Dockerfile` referencing 2026.4.2 (when
`assertExplicitProxyAllowed` was introduced) left as-is

## Risk

The Dockerfile runtime patches (fetch-guard export rewrite,
`assertExplicitProxyAllowed` bypass, `lstat`→`stat`, `replaceConfigFile`
EACCES) grep for specific symbols in the OpenClaw dist. These are
**fail-close** — if 2026.4.8 renamed or removed any symbol, the Docker
build will abort immediately.

## Test plan

- [ ] CI lint + unit tests pass
- [ ] Nightly E2E (triggered via `workflow_dispatch`) passes with the
new version
- [ ] Docker build succeeds (patches apply cleanly against 2026.4.8
dist)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Bumped default OpenClaw CLI version from 2026.4.2 to 2026.4.9 across
build configuration, agent manifest, and blueprint metadata.
* **Tests**
* Updated test fixtures and expectations to reflect the OpenClaw version
change (2026.4.9).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->