ci(openclaw): Docker image build workflow with Renovate auto-bump

[bussyjd]

Summary

• Add GitHub Actions workflow to build and publish ghcr.io/obolnetwork/openclaw from upstream openclaw/openclaw at a pinned version
• Add internal/openclaw/OPENCLAW_VERSION with Renovate inline hint for automatic upstream tracking
• Add Renovate custom manager + package rule so new upstream releases auto-open bump PRs

How it works

1. OPENCLAW_VERSION pins the upstream tag (e.g. v2026.2.3)
2. Renovate detects new openclaw/openclaw GitHub releases → opens PR to bump the version file
3. Merging the PR triggers the workflow (path filter on internal/openclaw/**)
4. Workflow clones upstream at the pinned tag, builds multi-platform image (amd64+arm64), pushes to GHCR
5. Trivy security scan runs on the published image

Files

File	Purpose
.github/workflows/docker-publish-openclaw.yml	Build + publish workflow (modeled on charon-dkg-sidecar)
internal/openclaw/OPENCLAW_VERSION	Pinned upstream version with Renovate hint
renovate.json	New custom manager + package rule for OpenClaw

Test plan

• Verify workflow syntax is valid (Actions tab)
• Trigger via push to feat/openclaw-ci branch (workflow_dispatch not available until workflow is on default branch)
• Confirm image published to ghcr.io/obolnetwork/openclaw — verified with docker manifest inspect and docker pull
• Confirm multi-platform manifest (amd64 + arm64)
• Confirm Trivy security scan passes
• Confirm Renovate picks up the version file (check dependency dashboard after merge)
• Remove test branches from workflow triggers (limit to main only) — see TODO comments in workflow

Test runs

Run	Result	Link
#1 — build-and-push	✅ success	21860388194
#1 — security-scan	❌ failed (stale Trivy action SHA)	fixed in subsequent commit
#2 — build-and-push	✅ success	21861952973
#2 — security-scan	✅ success	21861952973

Published image tags

• ghcr.io/obolnetwork/openclaw:2026.2.3
• ghcr.io/obolnetwork/openclaw:2026.2
• ghcr.io/obolnetwork/openclaw:latest
• ghcr.io/obolnetwork/openclaw:104c03b (git sha)

Note: Tags use semver without v prefix (e.g. 2026.2.3 not v2026.2.3). The chart values.yaml currently references v2026.2.3 — needs alignment.

Closes #142

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[OisinKyne]

Would prefer this to be in a separate repo tbh, not sure if it needs to be in this one