fix: preserve OpenClaw plugin discovery defaults

[peg]

Summary

• Preserve OpenClaw's default plugin discovery when plugins.allow is absent during rampart setup openclaw.
• Treat an absent OpenClaw plugin allowlist as unrestricted for Rampart status/doctor detection.
• Add a doctor warning for restrictive plugins.allow configs that have not switched bundled provider discovery to allowlist mode.
• Update setup help and regression coverage for absent and existing allowlist behavior.

Tests

• git diff --check
• go test ./cmd/rampart/cli ./internal/openclaw/hardening ./internal/plugin/openclaw
• go test ./...
• Isolated rampart serve on port 19090 with temporary HOME/config/audit directories; verified /v1/status, /v1/tool/exec allow and hosted-approval responses, audit JSONL correlation, and rampart audit verify --audit-dir <temp-audit-dir>.