Bug: Subagent spawn fails with "pairing required" when gateway uses TLS

Environment

• OpenClaw version: 2026.2.19-2
• Platform: Docker (Linux x64)
• Gateway config: mode: "local", bind: "lan", tls.enabled: true

Description

When gateway.tls is enabled (self-signed cert with autoGenerate: true), sessions_spawn fails because the spawned sub-agent connects to the gateway via wss:// but gets rejected with pairing required (WebSocket close code 1008).

Steps to Reproduce

1. Configure gateway with TLS:

{
  "gateway": {
    "mode": "local",
    "bind": "lan",
    "tls": { "enabled": true, "autoGenerate": true, "fingerprint": "<sha256>" },
    "auth": { "mode": "token", "token": "my-token" }
  }
}

2. Call sessions_spawn from within a session
3. Sub-agent connects to wss://<container-ip>:3000
4. Gateway closes connection with 1008: pairing required

Expected Behavior

The spawned sub-agent should inherit the parent's auth token and connect without requiring separate pairing.

Context

This is triggered by the security check that blocks ws:// to non-loopback addresses. In Docker, bind: "lan" resolves to the container bridge IP (e.g., 172.18.0.x), which is non-loopback → fails security check.

Enabling TLS solves the security check (wss:// is always allowed), but introduces the pairing issue because the sub-agent doesn't inherit auth credentials.

Workaround

None found. Without TLS, spawn fails with SECURITY ERROR. With TLS, spawn fails with pairing required.

The only scenario where spawn works is ws://127.0.0.1 (loopback), but setting bind: "loopback" breaks external access (Caddy reverse proxy, Docker port mapping).