Update OPENCLAW_GIT_REF to v2026.2.26

[GonzaloConsoli]

Update OPENCLAW_GIT_REF to v2026.2.26

[GonzaloConsoli]

Fix: Control UI "origin not allowed" error on Railway

Recent openclaw releases added an origin check to the Control UI WebSocket. On Railway the browser connects via https://<app>.up.railway.app, which the gateway was rejecting since it only knew its internal loopback address.

Changes:

• server.js: Added buildControlUiAllowedOrigins() + patchGatewayAllowedOrigins() — before the gateway process starts, the wrapper reads RAILWAY_PUBLIC_DOMAIN (auto-injected by Railway) and writes it into gateway.controlUi.allowedOrigins in openclaw.json. Custom domains are supported via a new OPENCLAW_CONTROL_UI_ALLOWED_ORIGINS env var (comma-separated).
• railway.toml: Added comment documenting the new optional variable.
• README.md: New troubleshooting section explaining the fix and how to add custom domains.

No action needed for the default Railway domain — it's fully automatic on the next deploy.