fix: wire qwenpaw worker image defaults

[RerankerGuo]

Summary

• Populate the dedicated QwenPaw Worker image in Docker, Kubernetes, and Sandbox backend configs.
• Expose the QwenPaw image repository and tag through Helm and pass the rendered image to the controller.
• Propagate explicit QwenPaw image overrides through the Bash and PowerShell installers, and wire local Makefile install targets to the locally built image.
• Add a regression test covering all three backend config constructors.

Root cause

QwenPaw runtime selection was added in #998, and each backend already has a QwenPaw-specific image branch. However, the controller config constructors never populated QwenPawWorkerImage, and Helm never supplied AGENTTEAMS_QWENPAW_WORKER_IMAGE. A runtime: qwenpaw Worker without an explicit spec.image therefore fell through to the default OpenClaw Worker image.

The Embedded install path also omitted the QwenPaw image override, so make install, make install-interactive, and make install-embedded could build the local image without making it available to the controller. The installer keeps this image opt-in: normal installs do not add a QwenPaw pull until a release image default is defined.

Verification

• go test ./... in hiclaw-controller/ with Go 1.25.0
• helm lint helm/hiclaw/ with Helm 3.14.0
• helm template with a custom QwenPaw repository/tag, parsed as YAML to assert the exact controller environment value
• bash -n install/hiclaw-install.sh
• PowerShell 7.6 AST parse of install/hiclaw-install.ps1
• make -n assertions for install, install-interactive, and install-embedded
• Recording-Docker installer simulation: the explicit image is persisted, pulled, and passed to the Embedded controller; the no-override path performs no QwenPaw pull
• git diff --check origin/main...HEAD

[github-actions]

❌ Integration Tests Failed (llm-interaction / mgr=copaw / wk=hermes)

Commit: 4344da1
Workflow run: #1666

Test Results

No test output captured.

Debug Log (tail)

No debug logs available.

---

📦 Download full debug logs & test artifacts

[github-actions]

❌ Integration Tests Failed (controller-cr / mgr=copaw / wk=copaw)

Commit: 4344da1
Workflow run: #1666

Test Results

No test output captured.

Debug Log (tail)

No debug logs available.

---

📦 Download full debug logs & test artifacts

[github-actions]

❌ Integration Tests Failed (llm-interaction / mgr=copaw / wk=copaw)

Commit: 4344da1
Workflow run: #1666

Test Results

No test output captured.

Debug Log (tail)

No debug logs available.

---

📦 Download full debug logs & test artifacts

[github-actions]

❌ Integration Tests Failed (llm-interaction / mgr=openclaw / wk=openclaw)

Commit: 4344da1
Workflow run: #1666

Test Results

No test output captured.

Debug Log (tail)

No debug logs available.

---

📦 Download full debug logs & test artifacts

[github-actions]

❌ Integration Tests Failed (controller-cr-2 / mgr=copaw / wk=copaw)

Commit: 4344da1
Workflow run: #1666

Test Results

No test output captured.

Debug Log (tail)

No debug logs available.

---

📦 Download full debug logs & test artifacts

[github-actions]

❌ Integration Tests Failed (controller-cr / mgr=copaw / wk=hermes)

Commit: 4344da1
Workflow run: #1666

Test Results

No test output captured.

Debug Log (tail)

No debug logs available.

---

📦 Download full debug logs & test artifacts

[github-actions]

❌ Integration Tests Failed (llm-interaction-2 / mgr=copaw / wk=copaw)

Commit: 4344da1
Workflow run: #1666

Test Results

No test output captured.

Debug Log (tail)

No debug logs available.

---

📦 Download full debug logs & test artifacts

[github-actions]

❌ Integration Tests Failed (llm-interaction-2 / mgr=openclaw / wk=openclaw)

Commit: 4344da1
Workflow run: #1666

Test Results

No test output captured.

Debug Log (tail)

No debug logs available.

---

📦 Download full debug logs & test artifacts

[github-actions]

❌ Integration Tests Failed (controller-cr / mgr=openclaw / wk=openclaw)

Commit: 4344da1
Workflow run: #1666

Test Results

No test output captured.

Debug Log (tail)

No debug logs available.

---

📦 Download full debug logs & test artifacts

[github-actions]

❌ Integration Tests Failed (llm-interaction-2 / mgr=copaw / wk=hermes)

Commit: 4344da1
Workflow run: #1666

Test Results

No test output captured.

Debug Log (tail)

No debug logs available.

---

📦 Download full debug logs & test artifacts

[RerankerGuo]

CI attribution for run #1664:

• Translation, change detection, the controller image, and all six downstream images passed.
• I inspected the raw logs for all 10 failed integration jobs. Every job has exactly one empty AGENTTEAMS_LLM_API_KEY, one LLM API Key is required installer error, make test-embedded exiting with error 2, and zero Running integration tests... markers.
• The matrix therefore stops in install-embedded before any shard or PR-specific test runs. This is the shared base-workflow secret bootstrap failure addressed by fix(ci): fall back to legacy LLM API key secret #1026.

The branch remains unchanged. Local go test ./..., Helm lint/template validation, and the structured QwenPaw image assertion are green.

[RerankerGuo]

CI attribution for head 4344da1, workflow run #1666:

• Change detection, the controller image, and all six downstream image builds passed.
• I inspected the raw logs for all 10 failed integration jobs. Every job has exactly one empty AGENTTEAMS_LLM_API_KEY, one LLM API Key is required installer error, make test-embedded exiting with error 2, and zero integration-test start markers.
• Every job also passes AGENTTEAMS_INSTALL_QWENPAW_WORKER_IMAGE= in the SKIP_BUILD=1 path and makes no QwenPaw image pull. This validates that the follow-up compatibility fix does not introduce an unavailable-image failure in CI.

The matrix therefore stops before any shard or PR-specific integration test runs. The remaining red checks are the fork-secret bootstrap issue addressed by #1026; no additional branch change is indicated by these logs.

[shiyiyue1102]

The deployment value is high because selecting the QwenPaw runtime must resolve to the dedicated Worker image across Docker, Kubernetes, and Sandbox backends. The current six-commit branch conflicts with main and spans nine files. Please rebase and squash the series into one coherent change, remove unrelated history, and verify that Helm values, controller configuration, Bash and PowerShell installers, and Sandbox defaults all render the same image contract.