picoclaw upstream gateway port=0 breaks spike test

[mostlydev]

Problem

TestSpikeRollCall/picoclaw fails with the picoclaw container crash-looping on:

```
FTL gateway src/pkg/gateway/gateway.go:139 > config pre-check failed: invalid gateway port: 0, port must be between 1 and 65535
```

This reproduces on master (verified independently of #136) so it is pre-existing, not introduced by the cllama ingress surface work.

Root cause

`examples/rollcall/Dockerfile.picoclaw-base` builds picoclaw via:

```dockerfile
RUN git clone --depth 1 https://github.com/sipeed/picoclaw.git .
```

This always pulls the upstream HEAD. Upstream picoclaw appears to have added a required `gateway.port` field in its config, but the clawdapus picoclaw driver (`internal/driver/picoclaw/config.go`) does not write a port — it relies on the picoclaw binary's defaults, which used to be 18790 but now seem to be 0 / unset.

Why it was masked until now

`TestSpikeRollCall/picoclaw` was skipped in CI for some time because the test only ran on machines with provider keys, and the picoclaw matrix entry needed an Anthropic key. As soon as a real key is present and the subtest runs, the upstream regression surfaces.

Fix options

1. Pin the picoclaw upstream commit in the Dockerfile (`git clone --depth 1 --branch ` or full clone + `git checkout `).
2. Have the picoclaw driver write `gateway.port: 18790` into `config.json` so the binary doesn't need to default it.
3. Both — pin the version AND emit the port for safety.

Option 2 is the right long-term fix and matches how the openclaw driver writes its own port config.

Acceptance criteria

• `TestSpikeRollCall/picoclaw` passes again with a fresh build of `Dockerfile.picoclaw-base`.
• The picoclaw driver no longer relies on undocumented upstream port defaults.

References

• Formalize cllama ingress surfaces and centralize runner protocol mapping #136 (original repro and root cause investigation)
• `internal/driver/picoclaw/config.go`
• `examples/rollcall/Dockerfile.picoclaw-base`