…d type fix (#588)

Drift gate (test/e2e/schema-drift.test.ts) spins up fresh PGLite + Postgres,
runs each engine's initSchema(), snapshots information_schema.columns, and
diffs the four-tuple (data_type, udt_name, is_nullable, column_default) per
column. 17 unit cases for the pure diff function (test/helpers/schema-diff.ts
+ schema-diff.test.ts) including a D3 negative test that reproduces the v0.26.1
oauth_clients.token_ttl regression. 6 E2E cases including 4 sentinels for
oauth_clients, mcp_request_log, access_tokens, eval_candidates.

The gate caught one real drift on its first run: access_tokens.id was UUID on
Postgres (schema.sql:328, migration v4) and TEXT on PGLite (pglite-schema.ts).
Reconciled to UUID DEFAULT gen_random_uuid() on both sides.

CI wiring in scripts/e2e-test-map.ts triggers schema-drift on changes to
schema.sql, pglite-schema.ts, or migrate.ts. The 2-table allowlist (files,
file_migration_ledger) is narrow by design — every other Postgres table must
reach PGLite via PGLITE_SCHEMA_SQL or a migration's sqlFor.pglite branch.

Bookkeeping: master HEAD's VERSION was 0.26.0 even though the prior commit
shipped as v0.26.1 (the bump never landed). Moving to 0.26.3 per the same
bookkeeping discontinuity. Codex flagged a versioning hardening follow-up
(scripts/check-version-sync.sh pre-push guard) for v0.26.4.

Also fixes two pre-existing CI failures master shipped through:
- check-privacy.sh: src/core/mounts-cache.ts had two banned name references
  ("Wintermute"). Replaced with "your OpenClaw" per CLAUDE.md:550.
- check-no-legacy-getconnection.sh: src/commands/integrity.ts:355 was a new
  legacy db.getConnection() caller. Added to the script's allowlist with a
  PR 1 cleanup note (matches the existing 8 grandfathered entries).

Out of scope (filed for v0.26.4): manual ALTER TABLE on production Postgres
that never made it into source files (the actual v0.26.1 trigger; needs a
gbrain doctor --schema-audit mechanism); index parity; versioning hardening
guard.

Plan + codex review pivot: original plan compared raw schema.sql vs raw
pglite-schema.ts; codex showed they're intentionally divergent today (PGLite
reaches its end-state via PGLITE_SCHEMA_SQL + migrations). Pivoted to
end-state comparison, which catches real drift without false positives.

Closes #588.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Master added v0.26.2 (#593) and v0.26.1 (#577) entries via the OAuth
fix-wave landing path. Resolved three conflicts:

- VERSION: kept 0.26.4 (this branch's version)
- package.json: kept 0.26.4
- CHANGELOG.md: kept both — v0.26.4 entry on top, then master's new
  v0.26.2 + v0.26.1 entries below. Final order: 0.26.4 → 0.26.2 →
  0.26.1 → 0.26.0 (top to bottom, contiguous version sequence).

Also fixed a banned-name reference master shipped in the v0.26.1
CHANGELOG credit line ("Co-authored by Wintermute" → "Co-authored by
your OpenClaw") per CLAUDE.md:550 / scripts/check-privacy.sh.

Regenerated llms-full.txt to match the merged CHANGELOG.

Verified post-merge: typecheck clean, schema-diff unit tests 17/17 pass.
Master's diff did not touch src/schema.sql, src/core/pglite-schema.ts,
or src/core/migrate.ts, so the new schema-drift gate's behavior is
unchanged.

Master added f082501 v0.26.3 feat(admin): observability + per-agent
config + auth hardening (#586), bringing migration v33 (oauth_clients
gets token_ttl + deleted_at; mcp_request_log gets agent_name + params
+ error_message), the magic-link admin login flow, and per-client TTL.

Resolved three conflicts (all bookkeeping, all version-related):

- VERSION: kept 0.26.6 (this branch's version, ahead of master's 0.26.3)
- package.json: kept 0.26.6
- CHANGELOG.md: my v0.26.6 entry on top, then master's new v0.26.3
  block, then the rest. Final order: 0.26.6 → 0.26.3 → 0.26.2 →
  0.26.1 → 0.26.0 (top to bottom, contiguous).

Auto-merged but needed cleanup:
- scripts/check-no-legacy-getconnection.sh: both sides added
  src/commands/integrity.ts to the allowlist with different notes.
  Deduped to one entry combining both notes.

Schema-drift gate sanity check post-merge:
- access_tokens.id is still UUID DEFAULT gen_random_uuid() in both
  schema.sql and pglite-schema.ts (my v0.26.3 D6 fix preserved)
- Master's new oauth_clients.token_ttl + .deleted_at columns are in
  both engines (master added them to schema.sql + pglite-schema.ts +
  migration v33's sqlFor — the gate is satisfied automatically)
- Master's new mcp_request_log.agent_name + .params + .error_message
  same story
- Typecheck clean, schema-diff unit tests 17/17 pass
- Privacy script clean

Regenerated llms-full.txt to match the merged CHANGELOG.