fix(lib): jsonl-store's docstring stops lying; mode option added; lib bypasses adopted

The header claimed 'single source of truth... the ONLY copy' with write-time
injection REJECTION — while appendJsonl never screened anything, only 1 of
~10 JSONL stores imported it, and a bypass appender lived in the same
directory. Now: the contract is explicit (screening is the CALLER's job via
hasInjection/firstInjectionMatch; the enforcing callers are named), a
option applies 0600 at create for sensitive stores, and the lib bypasses are
adopted (gstack-memory-helpers ×2, redact-audit-log — which keeps its chmod
backstop for files created looser by pre-mode versions). browse/src keeps
its own appenders by design (compiled-binary surface, own secure-append
helper) and the header now says so. gstack-decision's batched archive append
stays deliberate (single-write crash-window semantics appendJsonl's
one-record contract can't express).

New pins: 0600-at-create, and a test that documents appendJsonl does NOT
self-screen — so nobody can re-document it as self-screening without making
it true.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/host-adapters/openclaw-adapter.ts

@@ -1,45 +0,0 @@
-/**
- * OpenClaw host adapter — post-processing content transformer.
- *
- * Runs AFTER generic frontmatter/path/tool rewrites from the config system.
- * Handles semantic transformations that string-replace can't cover:
- *
- * 1. AskUserQuestion → prose instructions (tool call → "ask the user")
- * 2. Agent spawning → sessions_spawn patterns
- * 3. Browse binary patterns ($B → browser/exec)
- * 4. Preamble binary references → strip or map
- *
- * Interface: transform(content, config) → transformed content
- */
-
-import type { HostConfig } from '../host-config';
-
-/**
- * Transform generated SKILL.md content for OpenClaw compatibility.
- * Called after all generic rewrites (paths, tools, frontmatter) have been applied.
- */
-export function transform(content: string, _config: HostConfig): string {
-  let result = content;
-
-  // 1. AskUserQuestion references → prose
-  result = result.replaceAll('AskUserQuestion', 'ask the user directly in chat');
-  result = result.replaceAll('Use AskUserQuestion', 'Ask the user directly');
-  result = result.replaceAll('use AskUserQuestion', 'ask the user directly');
-
-  // 2. Agent tool references → sessions_spawn
-  result = result.replaceAll('the Agent tool', 'sessions_spawn');
-  result = result.replaceAll('Agent tool', 'sessions_spawn');
-  result = result.replaceAll('subagent_type', 'task parameter');
-
-  // 3. Browse binary patterns
-  result = result.replaceAll('`$B ', '`exec $B ');
-
-  // 4. Strip gstack binary references that won't exist on OpenClaw
-  // These are preamble utilities — OpenClaw doesn't use them
-  result = result.replace(/~\/\.openclaw\/skills\/gstack\/bin\/gstack-[\w-]+/g, (match) => {
-    // Keep the reference but note it as exec-based
-    return match;
-  });
-
-  return result;
-}