## Description
`headroom wrap openclaw` installed a non-existent npm spec — the
`--plugin-spec` default was `headroom-ai/openclaw`, which npm reads as a
GitHub shorthand and fails; the published package is `headroom-openclaw`
(see `plugins/openclaw/package.json`).
Fix introduces a single `OPENCLAW_NPM_PACKAGE = "headroom-openclaw"`
constant (kept in sync with `package.json` and the release env), uses it
as the default, and defers writing the `plugins.entries.headroom` config
until after a successful install so a hard failure leaves no stale
entry.
Closes#1969
## Type of Change
- [x] Bug fix (non-breaking change that fixes an issue)
## Changes Made
- `headroom/providers/openclaw/wrap.py` + `__init__.py`: canonical
`OPENCLAW_NPM_PACKAGE` constant.
- `headroom/cli/wrap.py`: use it as `--plugin-spec` default; write
config only after successful install.
- `tests/test_cli/test_wrap_openclaw.py`: expect `headroom-openclaw`;
install-before-config ordering; failed-install-writes-no-config test.
## Testing
- [x] Unit tests pass (`pytest tests/test_cli/test_wrap_openclaw.py`) —
29 passed
- [x] Linting passes (`ruff check`)
### Test Output
```text
29 passed
ruff: All checks passed!
```
## Real Behavior Proof
- Before: `wrap openclaw` → npm "unsupported spec" error; a failed
install left a stale config entry.
- After: installs `headroom-openclaw`; no config written on failure.
Add host-managed OpenClaw wrap and unwrap flows to the Docker-native wrappers so the installed headroom script can configure the OpenClaw plugin on the host while keeping Headroom itself in Docker. Reuse hidden prepare-only hooks for OpenClaw config payloads, preserve existing plugin metadata on unwrap, and update the Docker-native and integration docs to reflect the supported flow.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolve the PR merge conflict by carrying forward the secure TLS fail-closed rtk download behavior, bring in the latest upstream proxy-handler updates, and fix the OpenClaw linked-install fallback so it copies the required hook-shim directory with regression coverage.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
