chore: resolve merge conflicts and fix lint errors

- Add Extended Cognitive State endpoint (openclaw#66)
- Add Create Cognitive Event endpoint (openclaw#67)
- Add Create Affect Signal endpoint (openclaw#68)
- Add Patch Current Intent endpoint (openclaw#69)
- Add Get Explanation Hooks endpoint (openclaw#70)
- Update ToC with AERITH Runtime Wiring section

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Adds env_file directive to docker-compose.prod.yml for flexible environment configuration.

Benefits:
- Load environment variables from .env file (copy from .env.example)
- Easier local development and testing
- Cleaner separation of config from secrets
- Supports agent workspace development iteration

Related to agent self-development capability sprint.

deploy.sh previously only sed-updated the image tag in the VPS compose
file. New volume mounts (env_file, .env:/home/node/.env:ro, gitrepo)
from docker-compose.prod.yml never reached the VPS.

Changes:
- Add scp step to sync docker-compose.prod.yml -> VPS before deploy
- Add chown 1000:1000 for volumes/gitrepo bind-mount target
- Add .env placeholder creation to prevent Docker creating a directory
- Update deploy-vps.yml comment to reflect new sync behavior

style(overlay): update recording overlay theme to pink palette

Resolves contract drift across control UI host/render/gateway wiring and gateway server method typing so core gates return to green.

Refs openclaw#63

Refs openclaw#64

Refs openclaw#65

Refs openclaw#66

Refs openclaw#67

Applies oxfmt normalization to previously drifting docs and a small set of source/test/style files so pnpm check is fully green again.

Refs openclaw#67

openclaw#67)

Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 1.12.0 to 2.2.1.
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](actions/create-github-app-token@d72941d...29824e6)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…law#67)

* fix(slack:PLA-825): allow monitored incident thread follow-ups

* fix(slack:PLA-825): address review findings

* fix(slack:PLA-825): address follow-up review findings

* fix(slack:PLA-825): tighten thread follow-up ingress guard

* fix: clarify slack incident follow-up guards

* fix: rename slack incident follow-up bypass param

* refactor: clarify slack incident follow-up intent

* refactor(slack): clarify incident follow-up gates

* fix(slack): cover incident follow-up review gaps

* fix: preserve slack resolved follow-up filtering

* fix: drop dead slack incident ingress warn path

* refactor: clarify slack resolved-update suppression

* fix(slack): keep resolved follow-up suppression scoped

* fix(slack): audit approved incident follow-ups

* fix: address slack incident follow-up review notes

* fix(slack): allow bot-rooted incident follow-ups

* fix(slack): clarify incident thread follow-up guards

Two related gaps in the CHANGELOG write path both caused PRs to land
in the wrong place:

1) `resolve_merge_changelog_section` only consulted the environment
   override and PR labels. If a PR was only tagged with something
   like `size: S` (no `bug`/`fix`/`feature` label), the default fell
   through to Changes even when the PR title made the category
   obvious (e.g. `fix(cron): clean up deleteAfterRun direct
   deliveries` on PR openclaw#67807). That Conventional-Commits prefix is
   the repo's actual classification signal for most PRs and was
   being ignored.

   Add a title-prefix fallback after the label check: a title
   starting with `fix`, `bugfix`, or `hotfix` (followed by `(`, `:`,
   `!`, or whitespace) routes to Fixes; `feat`, `feature`, `enhance`
   route to Changes. Labels still win when present. Deliberately
   strict so `fixup!`, `fixing ...`, `fixture updates`, `featured
   posts` are not misread as `fix:`/`feat:`.

2) `appendUnreleasedChangelogEntry` deduped only on full-text
   equivalence. When a PR had a detailed entry written during
   prepare and then the merge step called `ensure_pr_changelog_entry`
   again with the short PR-title form, the two text bodies differed
   and the same PR got a duplicate line — that is what happened to
   PR openclaw#67679, which ended up with lines under both `### Changes` and
   `### Fixes`.

   Add a stronger precheck: scan the `## Unreleased` block for any
   existing bullet whose first PR reference matches the new entry's
   PR number. If one exists anywhere in the block (any sub-section),
   skip insertion. Dedup is scoped to Unreleased so the same PR
   number in a released block does not suppress a new Unreleased
   entry, and uses integer-equality on the PR number so `openclaw#67` is
   not shadowed by `openclaw#6767`.

Together these two changes cover both of the recently observed
failure modes:
- Missing section signal from labels (PR openclaw#67807) is now picked up
  from the title.
- Second ensure at merge time (PR openclaw#67679) no longer plants a
  duplicate in a different sub-section.

Covered by shell smoke (27 resolver scenarios) and vitest (12 cases
incl. the openclaw#67679 cross-section regression, released-block false
positive, and PR-number prefix collision).