ci(crabbox): harden docker hydration

.github/actions/setup-node-env/action.yml

@@ -101,7 +101,23 @@ runs:
         if [ -n "$LOCKFILE_FLAG" ]; then
           install_args+=("$LOCKFILE_FLAG")
         fi
+        append_pnpm_option_arg() {
+          local env_name="$1"
+          local option_name="$2"
+          local value="${!env_name-}"
+          if [ -n "$value" ]; then
+            install_args+=("--${option_name}=${value}")
+          fi
+        }
+        append_pnpm_option_arg PNPM_CONFIG_CHILD_CONCURRENCY child-concurrency
+        append_pnpm_option_arg PNPM_CONFIG_MODULES_DIR modules-dir
+        append_pnpm_option_arg PNPM_CONFIG_NETWORK_CONCURRENCY network-concurrency
+        append_pnpm_option_arg PNPM_CONFIG_VIRTUAL_STORE_DIR virtual-store-dir
         pnpm "${install_args[@]}" || pnpm "${install_args[@]}"
+        if [ -n "${PNPM_CONFIG_MODULES_DIR:-}" ]; then
+          rm -rf node_modules
+          ln -s "$PNPM_CONFIG_MODULES_DIR" node_modules
+        fi
 
     - name: Save pnpm store cache
       if: inputs.install-deps == 'true' && steps.pnpm-cache.outputs.cache-enabled == 'true' && steps.pnpm-cache.outputs.cache-hit != 'true'

.github/workflows/crabbox-hydrate.yml

@@ -31,6 +31,10 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  PNPM_CONFIG_CHILD_CONCURRENCY: "1"
+  PNPM_CONFIG_MODULES_DIR: "/tmp/openclaw-pnpm-node-modules"
+  PNPM_CONFIG_NETWORK_CONCURRENCY: "1"
+  PNPM_CONFIG_VIRTUAL_STORE_DIR: "/tmp/openclaw-pnpm-virtual-store"
 
 jobs:
   hydrate:
@@ -85,8 +89,23 @@ jobs:
             sudo chmod 666 /var/run/docker.sock
           fi
 
+          if ! docker buildx version >/dev/null 2>&1; then
+            arch="$(uname -m)"
+            case "$arch" in
+              aarch64|arm64) buildx_arch=arm64 ;;
+              x86_64|amd64) buildx_arch=amd64 ;;
+              *) echo "unsupported buildx arch: $arch" >&2; exit 2 ;;
+            esac
+            buildx_version="${DOCKER_BUILDX_VERSION:-v0.15.1}"
+            mkdir -p "$HOME/.docker/cli-plugins"
+            curl -fsSL \
+              "https://github.com/docker/buildx/releases/download/${buildx_version}/buildx-${buildx_version}.linux-${buildx_arch}" \
+              -o "$HOME/.docker/cli-plugins/docker-buildx"
+            chmod 0755 "$HOME/.docker/cli-plugins/docker-buildx"
+          fi
+
           docker version
-          docker buildx version || true
+          docker buildx version
           docker compose version || true
 
       - name: Hydrate provider env helper