重构主控编排与运行时预热链路，统一工作区提示词/专家调度协议并补齐 wiki 记忆注入与写回闭环。

同时收敛启动与运维脚本默认行为（含 wiki worker）、更新 Admin 可观测性与相关测试，降低首轮时延并提高运行稳定性。

Made-with: Cursor

openclaw/scripts/proxy-install-ca.mjs

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import process from "node:process";
+import { resolveSystemBin } from "../src/infra/resolve-system-bin.js";
+import { ensureDebugProxyCa } from "../src/proxy-capture/ca.js";
+import { resolveDebugProxySettings } from "../src/proxy-capture/env.js";
+
+const printOnly = process.argv.includes("--print-only");
+
+async function installCa() {
+  const settings = resolveDebugProxySettings();
+  const ca = await ensureDebugProxyCa(settings.certDir);
+  process.stdout.write(`Debug proxy CA: ${ca.certPath}\n`);
+  if (printOnly) {
+    process.stdout.write("Created or reused the debug proxy CA without changing system trust.\n");
+    return;
+  }
+
+  if (process.platform !== "darwin") {
+    process.stdout.write(
+      "Automatic CA trust is only implemented for macOS. Use the printed CA path to trust it manually on this platform.\n",
+    );
+    return;
+  }
+
+  const security = resolveSystemBin("security");
+  if (!security) {
+    throw new Error("security CLI is required on macOS to trust the debug proxy CA");
+  }
+
+  const result = spawnSync(
+    security,
+    [
+      "add-trusted-cert",
+      "-d",
+      "-r",
+      "trustRoot",
+      "-k",
+      "/Library/Keychains/System.keychain",
+      ca.certPath,
+    ],
+    {
+      stdio: "inherit",
+    },
+  );
+  if (result.status !== 0) {
+    throw new Error(`security add-trusted-cert failed with exit code ${result.status ?? 1}`);
+  }
+  process.stdout.write("Trusted the OpenClaw debug proxy CA in System.keychain.\n");
+}
+
+void installCa().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});