fix(runtime): support current OpenClaw build-local

[fuller-stack-dev]

Summary

• prefer OpenClaw's current scripts/ocm-npm-workspace-deps.mts adapter while retaining .mjs fallback compatibility
• compute the complete transitive workspace dependency closure across dependencies, optional dependencies, peer dependencies, and dev dependencies
• handle cycles without repacking the root package, and fail closed when a referenced workspace package is missing
• force the trusted local npm pack lifecycle even when ambient npm configuration has ignore-scripts=true

Archive rewriting remains owned by OpenClaw. This PR does not add managed-Node support, snapshot/rollback behavior, or convergence retries.

Review decisions

• omitted the supplied install-command context change because it was unrelated diagnostic polish rather than part of the broken build-local invariant
• corrected the supplied closure implementation by seeding the root package as visited, preventing a dependency cycle back to the root from packing it as a workspace dependency
• kept the implementation at the existing runtime build-local owner in src/store/runtimes.rs

This is the focused runtime subset overlapping #60; it intentionally excludes that PR's lifecycle, snapshot, and retry changes.

Proof

Red reproduction on unmodified d1c36adda05c1129af9788be35528bc1240d95da confirmed three independent failures:

1. the .mts workspace adapter was not invoked
2. nested workspace dependencies were omitted
3. ambient ignore-scripts=true silently skipped trusted prepack

Validation on c22dc5b41c1b0d12603e1cd80a5285748c02e3c3:

• focused build-local tests: 6/6 passed (18.88s)
• runtime unit tests: 3/3 passed
• full cargo test --locked with ulimit -n 4096: passed (122.41s)
• cargo check --workspace --all-targets --locked: passed
• cargo fmt --all -- --check: passed
• git diff --check: passed
• cargo build --release --locked: passed (59.52s)
• source-blind behavior validation: passed (2.31s)
• autoreview: no actionable findings, confidence 0.94; TruffleHog clean

Exact real OpenClaw build-local E2E used:

• OCM: c22dc5b41c1b0d12603e1cd80a5285748c02e3c3
• OpenClaw base: 5179e1235293bbd80c623cf3b6359414b1cb1e74
• transitive tarball head: 22ad7d29af7c0da2d50259ab3f0365a7b9820e8f (fix(scripts): let OCM install transitive workspace packages openclaw#122214)
• standalone prepack smoke head: 57b93482e640db32bb10467f72aad50a19eceeea (fix(scripts): keep bundled channel smoke standalone openclaw#122212)
• combined OpenClaw test SHA: 7f77ff34273cd93d9bb7ee7ccda32a603ee5d418
• host Node/npm: Node 24.18.1, npm 11.16.0, scripts enabled
• command: ocm runtime build-local current-openclaw --repo . --raw
• duration: 206.54s

The installed runtime verified healthy as OpenClaw 2026.8.1 (7f77ff3). Installed openclaw and @openclaw/ai were both 2026.8.1; @openclaw/normalization-core and @openclaw/session-url-contract were present at 0.0.0-private, with the rewritten root-to-AI and AI-to-normalization versions matching exactly.

[fuller-stack-dev]

Landed via SHA-pinned squash merge as c34c7072bf2802beb46385ed5d9fb05b44e5ce1b after all five required checks passed on head 455303af70d12ab8f94979c3f78fb23f559a22f2. The transient Ubuntu ETXTBSY source-watch test failure passed on exact rerun without source changes.

[steipete]

OpenClaw Performance release validation is blocked on the first OCM release containing c34c707.

The current OpenClaw workflow pins v0.2.29 and has a Bash trampoline for the .mts npm adapter. In both release-validation runs below, tsx rejects the adapter's complex hashbang before any Kova scenario executes:

• https://github.com/openclaw/openclaw/actions/runs/31870866801
• https://github.com/openclaw/openclaw/actions/runs/31871544450

v0.2.31 predates this merge. I prepared the version-only v0.2.32 release PR at #81. After squash merge and green exact-head main CI, an OCM owner can rerun scripts/release.sh 0.2.32 to create the signed tag and publish ocm-x86_64-unknown-linux-gnu.tar.gz.

Once it is published, I will pin the release and SHA-256 in OpenClaw, remove the local trampoline, land the workflow regression coverage, and rerun Performance against immutable OpenClaw release SHA 8f382a202ff1e15833394b481615dcdda99b04d7.