fix(deps): migrate runtime adapters to 0.99.2

[FenjuFu]

Which issue(s) this PR fixes:

Closes #86

Summary

• Upgrade both runtime libraries together to ^0.99.2 in the SDK and distributable package, with one locked copy of each. Group @earendil-works/* dependency updates in Dependabot.

• Use normalized transcripts and JSON object tool arguments in the ports and test support. Replay system instructions and tool changes into the OpenClaw host completion context while preserving message and tool-result content.

• Pass OpenCode's host fetch through the provider request options. Codex uses SSE with a host fetch and rejects explicit WebSocket requests; unsupported Bedrock and Google custom-fetch combinations fail before starting a provider request. Document these limits.

• Cover transcript forwarding, instruction/tool replay, image tool results, stream start events, provider-failure cleanup, and host transport isolation with offline regressions.

• Replay the Hermes transcript into the Python host context so system instructions and tool definitions survive the bridge. Emit the stream start event and assert tools and one nonempty system message in the Python provider contract.

• Pin the Hermes E2E package install prefix to /usr/local and validate the installer during image build so initialization uses the same location as the plugin links. Load the s6 container environment before initialization so the Hermes CLI receives its required environment.

• Use the Hermes image's declared Python and YAML runtime for E2E configuration, preserve YAML 1.1 semantics and supported model settings, and fail initialization if the required configuration cannot be written.

• Wait for the actual Hermes memory provider configuration before E2E verification. Read the exact YAML value again during verification and keep the existing timeout and behavior assertions.

Checks

• Full workspace TypeScript build

• Lint and formatting, including the final transport guards and tests

• Package dry-run

• Seven new offline regressions pass, including real-provider SSE tests and a real Hermes worker/tool roundtrip with synthetic responses

• Package metadata points to iflytek/memflywheel

• pnpm run ci on Windows: lint, formatting and build pass; unchanged core tests fail on POSIX path assumptions and concurrent file replacement (EPERM). The separate SDK/host/extension run passes 134 of 137 tests; the three failures are Windows path assertions.

• Linux/macOS Node 22/24 CI matrix, including the enhanced Python provider contract

• Kubernetes end-to-end workflow

Special notes for reviewers

The Linux/macOS Node 22/24 matrix is the authoritative platform validation. No real provider credentials or paid model calls were used for the new regressions.

The existing Kubernetes OpenClaw scenario invokes legacy mock lifecycle events and pins host 2026.3.23, below the declared pluginApi >=2026.6.10. It does not validate native plugin loading or the current host lifecycle. The new transcript/completion regressions run offline; passing the Kubernetes workflow should not be read as native OpenClaw compatibility coverage.

The standalone Python contract on Windows stops at the existing POSIX shell-guard assertion before reaching the bridge section; the assertions were retained and the full contract is validated by the Linux/macOS jobs.