Bug Description

config.get correctly redacts sensitive values in the parsed field (replacing them with __OPENCLAW_REDACTED__), but the sourceConfig and runtimeConfig fields in the same response contain plaintext API keys, bot tokens, and gateway auth tokens.

This means any agent session that calls config.get receives all credentials in cleartext within its context window, and they get persisted in session log files (.jsonl).

Steps to Reproduce

1. Configure OpenClaw with API keys in openclaw.json (providers, bot tokens, etc.)
2. In any agent session, call the config.get tool
3. Observe that parsed fields show __OPENCLAW_REDACTED__ ✅
4. Observe that sourceConfig and runtimeConfig fields contain plaintext keys ❌

Expected Behavior

All three fields (parsed, sourceConfig, runtimeConfig) should apply the same redaction logic for sensitive values.

Impact

• Credentials exposed to agent context windows
• Credentials persisted in session log files on disk
• Potential for accidental leakage if session logs are shared or backed up

Environment

• OpenClaw version: 2026.4.1
• OS: macOS (Apple Silicon)