feat: switch agent identity from openclaw.json to agents-sanitized.json

Completes P4 migration: Nexus API no longer reads openclaw.json.

Changes:
- AgentService: default path -> agents-sanitized.json
- OpenClawGatewayClient: LoadAgentIdsFromConfig + GetAvailableModels
  both now read from agents-sanitized.json
- compose.yaml: mount agents-sanitized.json instead of openclaw.json

The deploy script (.gitea/scripts/deploy-nexus.sh) already generates
agents-sanitized.json during deployment, extracting only the
section (list + defaults) without gateway/auth/password secrets.

DoD:
- No read access to openclaw.json from Nexus API container
- No uid-1654 ACL dependency for agent identity resolution
- No secrets in agent responses or config files

backend/Services/AgentService.cs

@@ -235,7 +235,7 @@ public sealed class AgentService(IConfiguration configuration, IAgentRuntime run
     private async Task<IReadOnlyList<AgentConfig>> LoadAgentConfigsAsync(CancellationToken cancellationToken)
     {
         var path = configuration.GetValue<string>("AgentConfigPath")
-            ?? "/home/node/.openclaw/openclaw.json";
+            ?? "/home/node/.openclaw/agents-sanitized.json";
 
         if (!File.Exists(path))
             return BuildFallbackConfigs();

backend/Services/OpenClawGatewayClient.cs

@@ -123,7 +123,7 @@ public sealed class OpenClawGatewayClient(HttpClient httpClient, IConfiguration
             )
         };
 
-        // Load agent IDs from openclaw.json config
+        // Load agent IDs from sanitized agents config (no secrets)
         var agentIds = LoadAgentIdsFromConfig();
 
         var agents = new List<DashboardAgentInfo>();
@@ -227,7 +227,8 @@ public sealed class OpenClawGatewayClient(HttpClient httpClient, IConfiguration
     }
 
     /// <summary>
-    /// Loads agent IDs from the OpenClaw config file (openclaw.json).
+    /// Loads agent IDs from the sanitized agents config (agents-sanitized.json).
+    /// No secrets — only agent list and defaults are exposed.
     /// Falls back to the known list if the config file is unavailable.
     /// </summary>
     private List<string> LoadAgentIdsFromConfig()
@@ -235,7 +236,7 @@ public sealed class OpenClawGatewayClient(HttpClient httpClient, IConfiguration
         try
         {
             var configPath = configuration.GetValue<string>("AgentConfigPath")
-                ?? "/home/node/.openclaw/openclaw.json";
+                ?? "/home/node/.openclaw/agents-sanitized.json";
 
             if (!System.IO.File.Exists(configPath))
                 return GetDefaultAgentIds();
@@ -1077,7 +1078,7 @@ public sealed class OpenClawGatewayClient(HttpClient httpClient, IConfiguration
     }
 
     /// <summary>
-    /// Returns the list of available models by reading from the OpenClaw config,
+    /// Returns the list of available models by reading from the sanitized agents config,
     /// with fallback to hardcoded list.
     /// </summary>
     public List<ModelOption> GetAvailableModels()
@@ -1085,7 +1086,7 @@ public sealed class OpenClawGatewayClient(HttpClient httpClient, IConfiguration
         try
         {
             var configPath = configuration.GetValue<string>("AgentConfigPath")
-                ?? "/home/node/.openclaw/openclaw.json";
+                ?? "/home/node/.openclaw/agents-sanitized.json";
 
             if (!System.IO.File.Exists(configPath))
                 return GetDefaultModels();

compose.yaml

@@ -68,7 +68,7 @@ services:
       retries: 3
       start_period: 15s
     volumes:
-      - /home/projekte_bao/openclaw/data/openclaw/openclaw.json:/home/node/.openclaw/openclaw.json:ro
+      - /home/projekte_bao/openclaw/data/openclaw/agents-sanitized.json:/home/node/.openclaw/agents-sanitized.json:ro
       - /home/projekte_bao/openclaw/data/openclaw/workspace-iris:/mnt/workspace-iris
       - /home/projekte_bao/openclaw/data/openclaw/workspace-programmer:/mnt/workspace-programmer
       - /home/projekte_bao/openclaw/data/openclaw/workspace-reviewer:/mnt/workspace-reviewer