Description

The OpenClaw WeChat plugin (@tencent-weixin/openclaw-weixin@2.4.2) is currently installed in the per-onboard Dockerfile (lines 384-396), not in Dockerfile.base.
This means every nemoclaw onboard pays the npm install cost again, including for
users who don't enable WeChat. The plugin lives behind npm install, so onboarding
is meaningfully slower than it needs to be.

A prior attempt (e23486b) moved the install into Dockerfile.base for exactly this
reason, but had to be reverted in d5edf8b because generate-openclaw-config.py
wholesale-rewrites openclaw.json on every onboard, wiping out the
plugins.installs.openclaw-weixin block that the base-image install had registered.
The plugin then failed to load at runtime and took Telegram (and every other channel)
down with it.

The d5edf8b commit message explicitly flags this as a follow-up:

Trade-off: every onboard pays the npm install cost again, including non-WeChat
users. Acceptable for now to unblock Telegram; the base-image caching can come
back once the install path doesn't conflict with the wholesale config rewrite.

This issue tracks landing that follow-up.

Reproduction Steps

1. Run nemoclaw onboard on a clean machine
2. Observe the openclaw plugins install '@tencent-weixin/openclaw-weixin@2.4.2'
   step runs during the per-sandbox image build, not the cached base image
3. Compare against Discord/Telegram/Slack plugins, which are baked into
   Dockerfile.base and skipped at onboard time

Proposed fix

Move the WeChat plugin install into Dockerfile.base while preserving the
plugins.installs.openclaw-weixin registry entry through onboard. Options:

• Teach generate-openclaw-config.py to merge with the existing openclaw.json
  rather than wholesale-rewriting it, so base-image plugins.installs entries
  survive
• Or, re-register plugins.installs.openclaw-weixin after generate-openclaw-config.py
  runs (cheaper than the full npm install)
• Move seed-wechat-accounts to run after whichever path lands

Environment

Not environment-specific — affects every onboard.

Checklist

• I confirmed this bug is reproducible
• I searched existing issues and this is not a duplicate