fix(installer): verify OpenClaw gateway readiness before reporting Done #94

An installer apply can report Done while the OpenClaw gateway is unavailable after a live update.

During PR #92's end-to-end validation, updating from an optional-key MCP provider to credential-free mode cleared the stored credential and obsolete native override successfully. The first agent call after that update timed out. The gateway log reported:

StateDatabaseCoordinatorContentionError: another OpenClaw process owns gateway-lifecycle

The installer nevertheless reported Done. Fresh-install agent discovery and tool calls passed. The reported post-update failure is a gateway lifecycle and success-reporting defect.

openclaw_gateway_script in charts/openshell-saw/files/installer/apply_bom.py is unchanged from PR #92's base commit fc385020014e51f1341b49a6bfe3819c3e09d246 (compared Python ASTs). It starts the gateway in the background and records the settings fingerprint without proving gateway readiness. This issue tracks that pre-existing behavior separately from the custom MCP provider changes in #92.

Acceptance criteria:

• A live harness/config update restarts the gateway without leaving a competing lifecycle owner, or reports an actionable failure.
• The installer verifies that the gateway is serving before reporting Done; sandbox Ready and openclaw --version alone are insufficient.
• A failed restart does not record a successful settings fingerprint that prevents recovery on the next apply.
• Regression coverage exercises a failed background restart and ensures apply/verification reports failure.
• Repeat the live optional-key to credential-free update and confirm that the next agent discovery/tool call succeeds.