core: replace hard-coded openclaw artifact checks with a binding registry (hello-agent prerequisite)

[yhay81]

Context

ADR 0004 and the upstream binding contract state that the embedding core is upstream-portable by design and that a hello-agent reference binding is the intended proof. A survey (2026-07-13) shows the core currently pins the artifact package name to the literal openclaw at these sites:

• packages/embed-sdk/embed-manifest.mjs: report identity check, manifest subject construction, manifest assertion (3 sites)
• packages/embed-sdk/permission-prompt.mjs: subject validation and construction (2 sites)
• packages/embed-sdk/report-loader.mjs: pinned-expectation check (1 site)
• packages/capability-broker/capability-broker.mjs: artifact validation (1 site)
• packages/embed-sdk/boot.mjs: imports the OpenClaw installer/gateway directly rather than receiving a binding

Design constraints (do not weaken the gate)

• Replace each literal with a check against an explicit, registered binding identity (e.g. the manifest/report must name a binding id whose package name matches exactly); an unknown or mismatched binding must fail closed exactly as an unknown package does today.
• Evidence remains bound to the exact artifact identity; a hello-agent report must never satisfy an openclaw gate or vice versa.
• bootVerifiedEmbed should receive the binding's installer/gateway constructors through the binding, keeping boot.mjs upstream-agnostic.
• Canonical sources change ⇒ SDK version bump (reproducible-tarball drift gate), so land together with the next planned bump.

Acceptance

• A provider-free hello-agent reference binding (fixture artifact identity is acceptable initially; a published trivial npm package can follow) passes manifest → permission → evidence-gate → loader flows in tests without touching any OpenClaw path.
• All existing OpenClaw contract tests unchanged and green.
• Tests are tarball-excluded, so test-only additions may land ahead of the refactor.

Found while executing the ADR 0004 roadmap; blocking-free (evidence capture is separately gated on the vendor Node baseline, #6).