fix(openclaw-plugin): require OpenClaw 2026.5.27

[r266-tech]

Summary

• raise the OpenClaw plugin install floor from 2026.4.8 to 2026.5.27
• keep package.json, package-lock.json, install-manifest.json, install guides, and the manifest contract test aligned
• call out the July 2, 2026 OpenClaw advisory batch in the user-facing install docs

OpenClaw versions below 2026.5.27 are covered by the July 2 advisory batch, including GHSA-8wg3-5mcm-fjq8 and GHSA-83w9-h5wv-j9xm. The package openclaw.* fields are intentionally kept aligned with the install manifest minimum because the installer treats them as host-version floor metadata.

Verification

• python3 -m json.tool on package.json, package-lock.json, and install-manifest.json
• checked the updated install/package contract surface for stale 2026.4.8 references
• Codex adversarial review: VERDICT: approve

[ZaynJarvis]

why is 5.27?

[r266-tech]

Because the two OpenClaw advisories linked in the PR both use 2026.5.27 as the first patched version for the openclaw npm package:

• GHSA-8wg3-5mcm-fjq8: vulnerable range < 2026.5.27, first patched 2026.5.27
• GHSA-83w9-h5wv-j9xm: vulnerable range < 2026.5.27, first patched 2026.5.27

So I treated 2026.5.27 as the minimum security floor for this plugin. Keeping the previous 2026.4.8 floor would still allow hosts covered by those advisories.

I kept the recommended OpenClaw version at 2026.6.6; this PR only raises the minimum package/install floor to the first patched version and keeps the manifest/package fields aligned because installers read those fields as host-version floor metadata.