GHSA-mqpw-46fh-299h: OpenClaw authorization bypass: operator.write can resolve exec approvals via chat.send -> /approve

A gateway client authenticated with a device token scoped only to operator.write (without operator.approvals) could approve/deny pending exec approval requests by sending a chat message containing the built-in /approve command.

exec.approval.resolve is correctly scoped to operator.approvals for direct RPC calls, but the /approve command path invoked it via an internal privileged gateway client.