feat(mock-sdk): cover public SDK subpaths

[vincentkoc]

What

• expand the mocked openclaw/plugin-sdk package used by isolated capture
• add named-export files for common public SDK subpaths like plugin-entry, channel-core, webhook-ingress, provider helpers, secret input, and SSRF/security helpers
• classify missing mocked SDK exports/modules in runtime capture JSON and Markdown

Why

Plugins increasingly import from SDK subpaths instead of only openclaw/plugin-sdk. The old mock mapped every SDK subpath to the root file, which made coverage brittle and hid which alias/export was actually unsupported.

Impact

• valid common SDK aliases import successfully in offline capture
• unsupported SDK aliases/exports now fail with failureClass metadata instead of a generic subprocess import error
• no runtime dependencies added

Checks

• node --test test/inspector.test.js test/runtime-capture-report.test.js
• npm run release:local