feat: add Gmail channel plugin

[jalehman]

What

Adds gmail-chan, a modern external OpenClaw channel plugin that uses Gmail threads as isolated conversations. Inbound messages in one Gmail thread share one OpenClaw session, different threads receive different sessions, and agent responses are delivered as authenticated, policy-constrained Gmail replies.

Why

The existing mcinteerj/openclaw-gmail project no longer works with the current OpenClaw plugin SDK. This implementation rebuilds the useful channel model against current OpenClaw APIs with bounded MIME parsing, deny-by-default delivery policy, Gmail API validation, durable receipts, and explicit security boundaries.

Changes

• Add modern external channel registration
• Map Gmail threads to sessions
• Poll unread Gmail messages safely
• Send RFC-compliant threaded replies
• Enforce inbound and outbound policy
• Validate authenticated sender domains
• Resolve literal and environment secrets
• Document setup, security, and limits
• Add CI and 38 unit tests

File	Change
src/channel.ts	Defines the OpenClaw channel adapters
src/gateway.ts	Polls and acknowledges inbound mail
src/inbound.ts	Routes authenticated mail into sessions
src/outbound.ts	Sends new messages and safe replies
src/gmail-client.ts	Wraps and validates Gmail API operations
src/message.ts	Parses bounded MIME and builds email
src/accounts.ts	Resolves accounts and OAuth inputs
openclaw.plugin.json	Declares plugin and channel configuration
README.md	Documents installation and operation
docs/spec.md	Records behavior and security boundaries

Testing

• pnpm check — lint, formatting, typecheck, 38 tests, and clean build pass
• pnpm audit --audit-level high — no known vulnerabilities
• npm pack --dry-run --json --ignore-scripts — 28 required package files
• OpenClaw plugins inspect gmail --runtime --json at 10853e82fdeb4939c8f3ed0f20697790a52fb617 — loaded with no diagnostics
• Autoreview and strict maintainability review — actionable findings addressed