security: constrain OpenClaw image and skill provisioning inputs

Summary

Make OpenClaw skills catalog-owned, contain every workspace operation, and enforce administrator-controlled image provenance and least privilege. Owner surfaces: dashboard/backend/handlers/openclaw.go, dashboard/backend/handlers/openclaw_skills.go, dashboard/backend/handlers/openclaw_provision.go, and dashboard/backend/handlers/openclaw_helpers.go.

Current behavior

Provisioning combines caller-selected image references with external skill identifiers used in filesystem operations, then starts the selected image with broad runtime privileges. Existing sanitization does not cover the skill boundary.

Expected behavior

Skills are selected only by strict server-catalog IDs, filesystem destinations cannot leave the owning workspace, images satisfy an administrator policy, and provisioned containers run with least privilege.

Acceptance

• Use a strict server-owned skill catalog ID and never an external path segment.
• Prove destination containment after symlink-aware resolution and reject aliases or unknown IDs.
• Copy known assets by server identity instead of extracting content through an arbitrary image command.
• Enforce administrator-controlled image allowlist, digest, and provenance policy.
• Run non-root with a read-only root filesystem and minimal capabilities.

Validation

• Add containment, separator, alias, symlink, unknown-ID, and image-policy negative tests without publishing host-specific paths.
• Add deployment tests for non-root identity, read-only root filesystem, and capability set.
• Run cd dashboard/backend && go test -race ./handlers.
• Run the affected OpenClaw E2E profile selected by the repo harness.

Related

• Parent audit: #2375
• Security index: #2357
• Dashboard state history: #1609