fix(security): clarify dmScope remediation path with explicit CLI command

[VintLin]

Problem

The security audit and onboarding screens suggested 'Set session.dmScope="..."'
for multi-user DM isolation. This led users to try setting the value in invalid
config paths (e.g., 'channels.imessage.dmScope').

Changes

• Updated 'src/security/audit.ts' to use 'formatCliCommand' for dmScope remediation.
• Updated 'src/commands/doctor-security.ts' and 'src/commands/onboard-channels.ts'
  to use the explicit 'openclaw config set' command format.

Validation

• Verified text alignment with 'pnpm tsgo'.
• Confirmed CLI command formatting remains consistent across modified files.

Fixes：#11642

Greptile Overview

Greptile Summary

This PR updates user-facing security guidance around DM session isolation (dmScope) to reduce confusion about where to set the config.

• src/security/audit.ts now recommends an explicit openclaw config set session.dmScope "per-channel-peer" CLI command (via formatCliCommand) instead of suggesting users manually edit a config path.
• src/commands/doctor-security.ts and src/commands/onboard-channels.ts similarly switch the DM-scope remediation text to an explicit CLI command, keeping the formatting consistent with other CLI hints (including profile injection handled by formatCliCommand).

No behavioral/security logic changes were introduced; this is primarily a messaging/UX clarification that aligns onboarding + audit output with supported configuration workflows.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk.
• Changes are limited to user-facing remediation strings and reuse the existing formatCliCommand helper; no control flow or security decision logic was modified. Verified the helper’s behavior with quoted arguments and found no whitespace/format issues in the diff.
• No files require special attention

[steipete]

Landed via temp rebase onto main.

• Gate: pnpm check && pnpm build && pnpm test (blocked by unrelated upstream TS/e2e failures on current main); targeted coverage: pnpm test src/security/audit.test.ts and pnpm test:e2e (doctor/onboard tests passed in run output)
• Land commit: 58f8b34
• Merge commit: 4337fa2

Thanks @VintLin!