#23780: Gateway: fail closed on insecure state directory permissions

## Summary - refuse gateway startup when OpenClaw state files are group/world readable or writable - inspect `$OPENCLAW_STATE_DIR`, `openclaw.json`, `.env`, and credentials files/directories - return actionable remediation guidance that points to `openclaw doctor --fix` ## Why This makes state-dir hardening fail-closed instead of best-effort, preventing accidental startup in insecure local-permission states. ## Tests - `pnpm vitest run src/gateway/startup-permissions.test.ts` <!-- greptile_comment --> <h3>Greptile Summary</h3> Added fail-closed permission checks during gateway startup to prevent insecure state directory configurations. The implementation inspects `$OPENCLAW_STATE_DIR`, `openclaw.json`, `.env`, and credentials files for group/world readability or writability, rejecting startup with actionable remediation guidance pointing to `openclaw doctor --fix`. - Introduced `assertGatewayStartupPermissionSafety()` in `src/gateway/startup-permissions.ts` that recursively audits state files and directories - Integrated permission checks into gateway startup sequence in `src/gateway/server.impl.ts` before plugin auto-enable - Added comprehensive test coverage including happy path, world-readable config, and group-readable credentials scenarios - Leverages existing `inspectPathPermissions()` infrastructure from `src/security/audit-fs.ts` for cross-platform permission inspection <h3>Confidence Score: 5/5</h3> - This PR is safe to merge with minimal risk - The implementation is well-structured, uses existing security infrastructure, handles edge cases properly (symlinks, missing files, Windows ACLs), and has thorough test coverage. The fail-closed approach is the correct security posture for permission validation. The integration point in the startup sequence is appropriate (after config validation, before plugin auto-enable). - No files require special attention _{Last reviewed commit: b75ef52} <!-- greptile_other_comments_section --> <!-- /greptile_comment -->