Bug Report: HiClaw provider=oss 需要 credential-provider 镜像，但该镜像未公开发布 || Bug Report: HiClaw provider=oss requires the credential-provider image, but the image is not publicly released

### Bug Description

问题描述

使用 storage.provider=oss 时，HiClaw 需要一个 credential-provider sidecar 容器来获取阿里云 STS 临时凭证，从而访问 OSS 存储。但该镜像未在任何公开 registry 发布，用户无法获取。

根本原因

阿里云 OSS 的 provider=oss 模式不走 S3 兼容协议，而是通过 hiclaw-credential-provider sidecar 联系阿里云元数据服务（100.100.100.200）获取 RAM 角色的 STS 临时凭证。

Helm values 中 credentialProvider.image.repository 需要用户自行提供镜像地址：

credentialProvider:
enabled: false # auto-forced to true when storage.provider=oss
image:
repository: "" # 无默认值，用户必须提供
tag: ""

官方文档中明确写明：

▎ "No default image is provided. In real deployments this is a customer-specific RAM-role-issuing service."

影响

- 用户无法通过 Helm values 配置静态 AK/SK 访问 OSS
- 没有公开可用的 credential-provider 镜像
- provider=oss 模式在非阿里云内部环境无法使用

建议修复

1. 在 Helm values 中增加静态 AK/SK 配置项，绕过 credential-provider（如 storage.oss.accessKey / storage.oss.secretKey）
2. 或在公开 registry 发布默认的 credential-provider 镜像供测试使用

### Steps to Reproduce

already

### AI Analysis

already

### Relevant Logs

```shell
already
```

### Component

Manager Agent

### Version / Commit

_No response_

---
### Bug Description

Problem description

When using storage.provider=oss, HiClaw requires a credential-provider sidecar container to obtain Alibaba Cloud STS temporary credentials to access OSS storage. However, the image is not published in any public registry and cannot be obtained by users.

root cause

The provider=oss mode of Alibaba Cloud OSS does not follow the S3 compatible protocol. Instead, it contacts Alibaba Cloud Metadata Service (100.100.100.200) through the hiclaw-credential-provider sidecar to obtain the STS temporary credentials for the RAM role.

credentialProvider.image.repository in Helm values requires the user to provide the mirror address:

credentialProvider:
enabled: false # auto-forced to true when storage.provider=oss
image:
repository: "" # No default value, user must provide
tag: ""

The official documentation clearly states:

▎ "No default image is provided. In real deployments this is a customer-specific RAM-role-issuing service."

influence

- Users cannot configure static AK/SK through Helm values to access OSS
- There is no publicly available credential-provider image
- provider=oss mode cannot be used in non-Alibaba Cloud internal environments

Suggested fix

1. Add static AK/SK configuration items in Helm values to bypass credential-provider (such as storage.oss.accessKey / storage.oss.secretKey)
2. Or publish the default credential-provider image in a public registry for testing use

### Steps to Reproduce

already

### AI Analysis

already

### Relevant Logs

```shell
already
```

### Component

Manager Agent

### Version/Commit

_No response_