fix(release): restore Kova matrix contracts

[vincentkoc]

What Problem This Solves

Kova main lost three release-validation contracts during history reconciliation: truncated payloads[].text recovery, calibrated process resource caps, and auth/model configuration before the first real OpenClaw service start. That made OpenClaw beta release performance fail despite successful agent turns and expected resource use.

Fixes #22.

Why This Change Was Made

• restore the bounded truncated-payload parser used by agent-turn evaluation
• restore the reviewed release resource thresholds and lock them with a self-check
• apply live auth and an explicit --model selection before the first service start
• preserve the Codex provider when OpenAI auth uses the external Codex CLI
• normalize host OS and Node versions in snapshots

The explicit model option replaces OpenClaw workflow-time source rewriting and lets callers request GPT 5.6 through Kova public CLI.

User Impact

OpenClaw release performance can distinguish product regressions from harness regressions again. Live runs select the intended model before startup, and successful truncated agent responses no longer become false failures.

Evidence

• npm run check (208/208)
• npm run test:snapshots (21/21)
• npm run check:web-payload (1/1)
• node --check on changed modules
• git diff --check
• fresh Codex autoreview: no accepted/actionable findings
• signed commit 2f48202248a37aad357bd70a6953475cd4816f81