OpenClaw version upgrade/attachment flexibility

### Problem Statement

OpenClaw integration is also rigid: the bundled OpenClaw version is relatively old, difficult to upgrade or customize, and there is no straightforward way for NemoClaw to sit on top of an existing OpenClaw deployment. This limits reuse for teams that already run OpenClaw in production.

### Proposed Design

1. Provide a cleaner way to upgrade/customize OpenClaw or attach NemoClaw to an existing OpenClaw deployment,
2. Maybe find a much better trade-off between security and maintainability here.

### Alternatives Considered

_No response_

### Category

enhancement: feature

### Checklist

- [x] I searched existing issues and this is not a duplicate
- [x] This is a design proposal, not a "please build this" request