fix(cli): make repair rollback state verifiable

[felirami]

Summary

• Make repair rollback outcomes truthful by reading configuration state back after every rollback write.
• Harden gateway-auth repair so existing tokens are preserved, generated tokens are checked without exposing their value, and partial failures clean up generated token state.
• Route thrown and structured nonzero repair failures through rollback, with regression and fault-path coverage.

Why

The previous rollback path treated a successful setter exit code as proof that the original state had been restored. A successful no-op setter could therefore leave authentication changed while reporting rollback success. Gateway token generation also needed a boolean-only presence boundary and explicit partial-failure cleanup.

Safety model

• Rollback succeeds only when the exact preflight value is observed afterward.
• No-op, mismatch, and unreadable rollback states fail closed.
• Existing gateway tokens are reused and preserved.
• Newly generated tokens are removed when later steps fail.
• Token values never enter repair evidence, results, notes, or tests.

Client-authentication usability remains an explicit external OpenClaw semantic because proving it end-to-end would require handling token material.

Validation

Exact reviewed head: 1d9af7dcb7ac1ccc4d256f222ec9128231b72574

• Node suite: 438/438 passed
• TUI suite (OPENTUI_LIBC=musl): 91/91 passed
• Repair-session E2E: 3/3 passed
• Adapter/catalog/engine safety suite: 105/105 passed
• Remediation contracts: 7/7 passed
• Repair validation: 50 scripts, 0 blockers
• npm audit --omit=dev: 0 vulnerabilities
• Canonical CLI package: 21/21 allowlisted files
• Syntax, diff, trailer, exact-SHA, and clean-worktree gates passed

Independent review reconstructed tree 8acb6df8345efc670f2e8ebfbc0fce542d1f8fdf from the immutable Buzz carrier, reproduced the exact tree, ran the full Node suite plus three additional fault probes, and found no blocking or material issues (96% confidence).

Attribution

This is Buzz + Felirami work. Operator implemented and verified the repair; Contrarian independently reviewed it and found the original blocking defect, then cleared the corrected exact tree.

Originating Buzz channel: agent-lab (4144552c-c494-4754-ab7f-c71be5535de6).