GHSA-hwpq-rrpf-pgcq: OpenClaw: system.run approval identity mismatch could execute a different binary than displayed

system.run approvals in OpenClaw used rendered command text as the approval identity while trimming argv token whitespace. Runtime execution still used raw argv. A crafted trailing-space executable token could therefore execute a different binary than what the approver saw.