MCP OpenClaw E2E no longer emits authenticated rewrite success marker

## Description

The OpenClaw MCP bridge E2E no longer emits its authenticated rewrite success marker in the first full-matrix run after the gateway lifecycle and credential-boundary changes.

Source run: https://github.com/NVIDIA/NemoClaw/actions/runs/35118412060
Failed job: https://github.com/NVIDIA/NemoClaw/actions/runs/35118412060/job/104870711248
Tested commit: `755f28d36022b13bb38e0c0d0c4a0e30599071dd`
Immediately preceding full run: https://github.com/NVIDIA/NemoClaw/actions/runs/35044497327 at `d3587e8495de6cfc1403aa66f20b3c4f06ce4286`

The lifecycle phase times out without the expected marker:

```text
MCP_AUTH_REWRITE_OK::
```

The job was not failing in the immediately preceding full-matrix run.

## Likely introducing change

Primary suspect, medium confidence: `7c776cdfa1c4928b641d00bddd5d57d113557ae2`, PR #11792: https://github.com/NVIDIA/NemoClaw/pull/11792

#11792 directly modified the OpenClaw MCP bridge adapter while transferring gateway ownership to native agents. The missing marker occurs after that ownership transition.

Secondary suspect: `5ed08878e99b9b79b54d2015fc45014321d3f07d`, PR #11865: https://github.com/NVIDIA/NemoClaw/pull/11865

#11865 changed gateway endpoint and credential handling in the same regression window. Current evidence does not prove which boundary suppresses the marker, so this issue records both and requires commit-boundary evidence before changing code.

## Expected result

- The bridge proves the supported authenticated rewrite behavior through a stable observable contract.
- Gateway ownership and credential validation remain fail-closed.
- No secret or bearer value is emitted in logs, artifacts, arguments, or the success marker.
- If the marker is obsolete but behavior is correct, replace it with a deterministic semantic assertion rather than weakening authentication coverage.

## Acceptance evidence

- [ ] Reproduce at the #11792 and #11865 commit boundaries, or provide equivalent focused evidence that isolates the first failing change.
- [ ] Classify the failure as product behavior, fixture setup, or stale assertion before repair.
- [ ] Add deterministic coverage for the isolated auth-rewrite boundary.
- [ ] Verify the focused OpenClaw MCP target on the final exact commit.
- [x] I searched open issues using the run ID, job ID, marker, MCP, OpenClaw, and auth-rewrite terms.

Start with the failed full-matrix run and compare commit boundaries at #11792 and #11865. Reproduce the focused OpenClaw MCP target, classify whether the failure is product behavior, fixture setup, or a stale assertion, then add deterministic coverage for the isolated authenticated rewrite boundary. Done means the final exact commit verifies the behavior without exposing secrets or weakening authentication.

Written by the indexing model from the issue text.