fix(reply): restore block streaming and migrate public SDK APIs

[steipete]

This preserves the block-streaming repair originally proposed here and moves Weixin onto the published public channel-turn SDK. The plugin advertised block streaming but forced disableBlockStreaming: true after v2.1.2; the existing change restores the enabled default with global and per-account opt-out. This refreshes the direction proposed in #94 against current main. Related: openclaw/openclaw#92199.

The SDK migration replaces temporary-directory imports from infra-runtime with temp-path, uses reply-payload for payload types, and replaces config load/overwrite with config-mutation.mutateConfigFile and an explicit automatic reload policy. Login still bumps the channel timestamp, but the host now mutates the current source configuration without replacing unrelated settings from a stale runtime snapshot.

Inbound messages now use channelRuntime.inbound.buildContext and channelRuntime.inbound.dispatch. OpenClaw owns session recording, reply dispatcher cleanup, and message hooks; Weixin retains transport formatting, typing, media delivery, progress messages, and account routing. The old plugin-local global-hook wrappers are removed, avoiding duplicate hook execution around host-managed outbound sends. Delivery returns provider message IDs to the host. Existing per-agent human-delay overrides and the block-streaming setting are preserved.

This source revision requires OpenClaw >=2026.8.1-beta.3, with the development dependency pinned to that published version. The current stable host lacks the routed dispatch API. The package metadata, startup guard, and English/Chinese documentation now state the same floor; the guard distinguishes earlier prereleases. No plugin version or published package is changed.

Three deprecated APIs remain with explicit migration blockers. First, infra-runtime.withFileLock protects the existing pairing-file writes. The focused file-lock export is a private official-plugin facade, not a public external-plugin replacement. Migrating that last use requires OpenClaw to publish an appropriate pairing-write or locking contract; this PR does not bypass that boundary with private imports, copied locks, or ambient declarations.

The two command-auth helpers also remain. Their public replacement, resolveStableChannelMessageIngress, rejects an empty pairing allowlist, while this plugin currently allows it when no saved login owner is available. That state is reachable: the legacy token loader returns credentials without a user ID, the QR response makes the user ID optional, and account startup requires only a token. Changing this policy in an SDK migration would silently break those installations. The follow-up needs a maintainer-approved upgrade path for those accounts before replacing resolveSenderCommandAuthorizationWithRuntime and resolveDirectDmAuthorizationOutcome; this PR neither copies the old authorization bypass nor tightens the policy implicitly.

Validation at commit da51a8c0aa651ec3638074b41c95769a54f3743a on isolated Linux with Node.js 24.19.0 and the exact published OpenClaw 2026.8.1-beta.3 dependency:

• npm install --ignore-scripts --no-audit --no-fund passed.
• npm run typecheck and npm run build passed.
• npm test passed: 409 tests across 29 files, including real SDK dispatch with streaming enabled/disabled, config reload preservation/failure handling, prerelease ordering, and structured-message transport failures. Branch coverage is 90.22%, above the unchanged 90% threshold.
• git diff --check passed. Each commit received the configured independent Codex review with no actionable findings at its P0 threshold.

The first isolated migration run had all 403 tests passing but failed the coverage gate at 89.07%. Adding the missing prerelease and transport-failure cases fixed that gap without changing production behavior or lowering coverage requirements. The source delta after the original block-streaming repair is net -127 production lines.

No live WeChat login or message was sent during this source migration. Upstream must merge and publish an updated plugin before existing npm consumers are migrated.