#16185: fix: patch systemd unit version before service restart

## Summary - After `openclaw update`, the systemd unit file retained the old `OPENCLAW_SERVICE_VERSION` and `Description` because `restartSystemdService()` only ran `systemctl --user restart` without touching the unit file - Add `patchSystemdUnitVersion()` that surgically patches only the `Description=` and `OPENCLAW_SERVICE_VERSION` env lines before restart, avoiding a full `installSystemdService()` which could clobber env vars from the original install environment - Add `serviceVersionMismatch` audit check so `openclaw doctor` catches stale versions as a safety net - Verified end-to-end: unit file updated from `v2026.2.12` → `v2026.2.13` on restart, service running cleanly Fixes #15513 Fixes #7710 ## Test plan - [x] `pnpm test src/daemon/systemd.test.ts` — 4 new tests for `patchSystemdUnitVersion` (patches version, no-op when current, no-op when missing, preserves other lines) - [x] `pnpm test src/daemon/service-audit.test.ts` — 3 new tests for version mismatch audit - [x] Manual: ran `openclaw gateway restart` on live system, confirmed unit file updated and service running <!-- greptile_comment --> <h3>Greptile Summary</h3> Adds `patchSystemdUnitVersion()` to surgically update only the version-related fields (`Description=` and `OPENCLAW_SERVICE_VERSION`) in the systemd unit file before restart, avoiding a full reinstall that could overwrite environment variables. Also adds a `serviceVersionMismatch` audit check to `openclaw doctor` for detecting stale service versions. - New `patchSystemdUnitVersion()` function patches version metadata in systemd unit files - Added optional `patchVersion` method to `GatewayService` interface, called before restart - New `serviceVersionMismatch` audit code detects version mismatches in `openclaw doctor` - Comprehensive test coverage for both patching logic and audit checks - One logic issue found: whitespace handling bug in line comparison could cause unnecessary rewrites <h3>Confidence Score: 4/5</h3> - Safe to merge with one minor logic fix recommended - Well-tested implementation with clear purpose and comprehensive test coverage. One logical error found in whitespace handling that could cause unnecessary file rewrites, but unlikely to cause issues in practice since OpenClaw-generated files don't have leading whitespace. Non-fatal error handling prevents blocking restarts. - Check `src/daemon/systemd.ts:316-322` for whitespace comparison logic _{Last reviewed commit: ef94e42} <!-- greptile_other_comments_section --> _{(2/5) Greptile learns from your feedback when you react with thumbs up/down!} <!-- /greptile_comment -->