Fix bundled plugin metadata copying to follow the build-entry set, so build-excluded plugins like QQ Bot do not leave stale dist metadata advertising missing runtime files.
Verification:
- pnpm test src/plugins/copy-bundled-plugin-metadata.test.ts test/scripts/bundled-plugin-build-entries.test.ts
- git diff --check
- pnpm openclaw gateway status --deep
- CI run 25718250461
- CodeQL run 25718250402
- CodeQL Critical Quality run 25718250418
- Real behavior proof run 25718290985
Simplify plugin installation and runtime loading around package-manager-owned dependencies, with Jiti reserved for local/TS fallback paths.
Also scans npm plugin install roots so hoisted transitive dependencies are covered by dependency denylist and node_modules symlink checks.