Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/nemoclaw-start.sh`:
- Around line 460-482: The script currently injects raw SLACK_BOT_TOKEN and
SLACK_APP_TOKEN into the JSON by string substitution (see variables bot_token,
app_token and the re.sub calls), which can break the JSON if tokens contain " or
\; replace the regex splicing with proper JSON parsing and serialization: load
the file with json.load, set the "botToken" and "appToken" fields to
bot_token/app_token (only set appToken if app_token is non-empty), then write
back using json.dump or json.dumps to ensure values are correctly escaped;
remove the two re.sub blocks and the direct string write to content in favor of
updating the parsed object and writing it with json.dump.

---

Nitpick comments:
In `@test/nemoclaw-start.test.ts`:
- Around line 572-584: Add an executable regression that exercises the regex
rewrite path: create a small test that runs the same re.sub(...) rewrite logic
on a sample openclaw.json fixture, writes the rewritten file, then re-parses it
to assert the rewrite produced valid shell/source equivalent to the original
semantics; locate the rewrite code invoked by apply_slack_token_override and the
re.sub(...) call, invoke that code path in the test, and add assertions that the
rewritten output can be parsed and preserves the expected
SLACK_BOT_TOKEN-related checks (e.g., the non-root return behavior and absence
of duplicate checks).