GHSA-cwj3-vqpp-pmxr: OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes

The agent-facing gateway tool protects config.apply and config.patch with a model-to-operator trust boundary. That guard used a hand-maintained denylist of protected config paths. The config schema outgrew that denylist, leaving sensitive subtrees writable through model-driven gateway config mutations.