fix(openclaw): rename virtual provider to llmspy for cloud model routing

[bussyjd]

Summary

• Renames the virtual provider in buildLLMSpyRoutedOverlay() from "ollama" to "llmspy" so OpenClaw correctly resolves cloud models through the llmspy gateway
• Adds llmspy/ prefix to AgentModel (e.g., llmspy/claude-sonnet-4-5-20250929) — required by OpenClaw's parseModelRef() which splits on / for provider routing
• Disables the default ollama provider when a cloud provider is selected to prevent dual-provider confusion
• Adds llmspy provider entry to chart values, _helpers.tpl, and deployment.yaml provider iteration lists
• Default Ollama-only path is unchanged (still uses ollama/glm-4.7-flash)

Root Cause

OpenClaw's model resolution (src/agents/model-selection.ts) requires provider/model format. Without a /, bare model names fall back to a hardcoded anthropic provider — which is disabled in the cloud overlay, silently breaking chat requests.

Request Chain (cloud path)

OpenClaw: model = "llmspy/claude-sonnet-4-5-20250929"
  → parseModelRef() → provider="llmspy", model="claude-sonnet-4-5-20250929"
  → llmspy provider → baseUrl: http://llmspy.llm.svc.cluster.local:8000/v1
  → llmspy resolves model to Anthropic → forwards upstream

Test plan

• All 30 openclaw tests pass (go test ./internal/openclaw/ -v)
• go build ./cmd/obol compiles successfully
• Deploy with obol openclaw setup using Anthropic/OpenAI and verify chat works
• Verify default Ollama path still works (no cloud provider selected)

To fix the problem, we should ensure that no sensitive information (API keys or their direct representations) is written to logs or stdout. Instead of interpolating p.APIKey into the fmt.Printf message, we can log only that the provider uses an env-var reference, without revealing its exact value. This preserves all functional behavior: the configuration parsing and result construction remain unchanged; only the informational note is redacted.

Concretely, in internal/openclaw/import.go, within detectExistingConfigAt, update the else if p.APIKey != "" branch (around line 146) to remove %s and the p.APIKey argument from the format string. A safe message would be " Note: provider '%s' uses env-var reference (will need manual configuration)\n", which still tells the user what to do but does not leak the value. No extra imports, methods, or type changes are needed; this is a minimal logging-format change.