Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…rvice

Phase 2 of the orchestrator refactoring. Transforms the service from a
Docker-only proxy into a full cloud-capable control plane.

- SAE Backend: manage worker lifecycle via Alibaba Cloud SAE API (Go SDK v4)
- APIG Backend: manage AI Gateway consumers (Go SDK v6)
- Auth middleware: two-tier auth with static manager key + per-worker API keys
- STS Token Service: centralized credential issuance with per-worker OSS policy
- OSS key persistence: worker API keys stored in OSS for recovery across restarts
- Worker shell rewrite: oss-credentials.sh now uses orchestrator-mediated STS refresh
- Shared httputil package: consolidated writeJSON/writeError across packages

Workers have no OIDC capability — orchestrator is the sole credential issuer.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Phase 3: replace direct Docker API calls and Python/Shell SAE wrappers
with thin orchestrator REST API client.

- Rewrite container-api.sh: worker_backend_* now call orchestrator /workers/* API
- Simplify gateway-api.sh: cloud path calls orchestrator /gateway/* API
- Simplify create-worker.sh Step 9: unified orchestrator call, no Docker/SAE split
- Delete aliyun-sae.sh and aliyun-api.py (replaced by orchestrator Go backends)
- Remove Python SDK dependencies from Dockerfile.aliyun

Net deletion: ~1100 lines of shell/Python code.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1. Unify HICLAW_CONTAINER_API → HICLAW_ORCHESTRATOR_URL (single env var)
2. Remove HICLAW_RUNTIME from create-worker.sh (orchestrator decides)
3. Make image optional in worker create API (backend provides default)
4. Add Timestamp to STS AssumeRoleWithOIDC call
5. SAEBackend.Create() auto-injects HICLAW_RUNTIME=aliyun into worker env
6. oss-credentials.sh: support dual path (RRSA direct + orchestrator mediated)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- SAEBackend.Create() polls DescribeApplicationStatus until RUNNING (max 120s)
- New POST /workers/{name}/ready endpoint for worker self-reporting
- GET /workers/{name} merges readiness: running + reported ready = "ready"
- Worker entrypoints (openclaw + copaw) report ready to orchestrator in background
- New worker_backend_wait_ready() in container-api.sh for unified readiness polling
- create-worker.sh Step 9 uses unified wait instead of Docker exec-based polling

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Eliminate all backend-specific logic from handler and main layers:

- Add NeedsCredentialInjection() to WorkerBackend interface
- Move credential injection (API key, orchestrator URL, HICLAW_RUNTIME)
  into SAEBackend.Create() — handler no longer checks b.Name()
- Replace cfg.Runtime == "aliyun" checks with config-driven backend
  registration (buildBackends function)
- Delete IsAliyunRuntime() global function
- Delete Config.Runtime field
- Backend Available() now checks own config, not global env var

"aliyun" string now only exists inside sae.go (backend internal).
Handler and main layers are fully backend-agnostic.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Each backend now declares its deployment mode ("local" or "cloud") via
the DeploymentMode() interface method. The API response includes a new
deployment_mode field, eliminating the backend-name-to-mode translation
in create-worker.sh (5 lines → 1 line).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…g after rebase

Upstream refactor(network) replaced ExtraHosts with Docker network aliases
on the manager container. Remove leftover ExtraHosts injection in
create-worker.sh and duplicate hiclaw-net setup in install scripts.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Add ensureImage() to auto-pull missing images before container create
- Handle 409 Conflict by deleting existing container and retrying once
- Add ExposedPorts/PortBindings support for CoPaw console port mapping
  with port conflict retry (up to 10 attempts)
- Pass complete env vars (FS credentials, orchestrator URL) when
  recreating workers in lifecycle-worker.sh and start-manager-agent.sh
- Pass HICLAW_WORKER_IMAGE and HICLAW_COPAW_WORKER_IMAGE to orchestrator
  container in install scripts so it knows which images to use
- Extract console_host_port from orchestrator response in create-worker.sh
  and enable-worker-console.sh

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

… persist docs, delete bug

- Worker/CoPaw readiness reporters now heartbeat every 60s after initial
  ready, so orchestrator restarts self-heal without persistence
- Add comment documenting persist-outside-lock trade-off in keys.go
- Fix _detect_worker_backend call in lifecycle-worker.sh action_delete
  (function was removed in refactor, replaced with container_api_available)
- Add backward-compat env var fallback for HICLAW_INSTALL_DOCKER_PROXY_IMAGE
- Update stale comment in copaw-worker-entrypoint.sh

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>