GHSA-rw39-5899-8mxp: OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv

In affected versions of openclaw, node-host system.run approvals could display only an extracted shell payload such as jq --version while execution still ran a different outer wrapper argv such as ./env sh -c 'jq --version'.