fix(runtime): migrate state before OpenClaw setup

[osolmaz]

Opened on behalf of Onur Solmaz (osolmaz).

Summary

GoEPT restored its saved OpenClaw state, but OpenClaw 2026.9.2 rejected the older configuration before MLClaw reached its migration step.
This change runs OpenClaw Doctor immediately after restore and before baseline setup validates the configuration.
It preserves the same state, secret isolation, and operation order after migration, and prepares MLClaw 0.12.7.

What Changed

The existing safe migration command moves earlier in startup.
It still runs without MLClaw, Hugging Face, OpenAI, or Telegram credentials in its process environment.

• Run openclaw doctor --fix --non-interactive after protected-state preparation and before openclaw setup --baseline.
• Keep model, Telegram, OAuth, and runtime startup after migration.
• Add an ordering assertion that prevents setup from moving before migration again.

Testing

The migration and runtime-image tests passed, and the complete MLClaw quality gate passed under Node.js 24.

• npm test -- --run test/mlclaw.runtime-image.test.ts test/mlclaw.openclaw-state-migration.test.ts
• npm run check
• git diff --check

Risks

Doctor now runs before baseline workspace setup on every restored startup.
It uses OpenClaw's supported noninteractive repair command and has no access to deployment credentials.