Merge origin/main into feat/guardrail_interface and align E2E expectations

[nwinter]

Summary

This PR does two things:

1. Syncs feat/guardrail_interface with upstream origin/main (conflict-resolved merge).
2. Fixes follow-up E2E expectations so tests match current hook/OAuth behavior.

Merge sync details

• Merged upstream main into the guardrail branch.
• Resolved conflicts in:
  • src/agents/pi-embedded-runner/run.ts
  • src/agents/pi-embedded-subscribe.handlers.tools.ts
• Resolution preserved both:
  • compaction-timeout behavior from upstream
  • guardrail/hook metadata behavior from the guardrail branch

E2E follow-up fixes

• Updated after-tool-call adapter E2E expectations:
  • src/agents/pi-tool-definition-adapter.after-tool-call.e2e.test.ts
• Updated Chutes manual OAuth E2E flow to use full redirect URLs with code + state:
  • src/commands/chutes-oauth.e2e.test.ts
  • src/commands/auth-choice.e2e.test.ts

Validation

• pnpm test passed
• pnpm test:e2e passed (full suite)

(made by Codex)

[github-actions]

⚠️ Formal models conformance drift detected

The formal models extracted constants (generated/*) do not match this openclaw PR.

This check is informational (not blocking merges yet).
See the formal-models-conformance-drift artifact for the diff.

If this change is intentional, follow up by updating the formal models repo or regenerating the extracted artifacts there.

[github-actions]

⚠️ Formal models conformance drift detected

The formal models extracted constants (generated/*) do not match this openclaw PR.

This check is informational (not blocking merges yet).
See the formal-models-conformance-drift artifact for the diff.

If this change is intentional, follow up by updating the formal models repo or regenerating the extracted artifacts there.