Harden attachment access controls and stabilize the Weixin bridge.

This persists referenced media safely, adds explicit attachment ACL/backfill flows, and fixes the Weixin sidecar so official login state can bridge reliably into oclaw without duplicate replays or dropped replies.

Made-with: Cursor

runtime/operations/weixin_bridge/login.ts

@@ -0,0 +1,16 @@
+import { spawn } from "node:child_process";
+
+function run(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const child = spawn("openclaw", ["channels", "login", "--channel", "openclaw-weixin"], {
+      stdio: "inherit",
+      shell: true,
+    });
+    child.on("error", reject);
+    child.on("exit", (code) => resolve(code ?? 1));
+  });
+}
+
+void run().then((code) => {
+  process.exitCode = code;
+});