fix(openclaw): upsert and attach inference provider at AgentHarness sandbox creation

[nloke]

Problem

When deploying an AgentHarness using the openclaw backend, the agent starts and Slack connects successfully, but all LLM calls fail with a Connection error.

Root Cause

openclaw uses an HTTP proxy (HTTPS_PROXY=http://10.200.0.1:3128) to resolve credentials at request time. The openclaw.json config stores an unresolved placeholder:

"apiKey": "openshell:resolve:env:OPENAI_API_KEY"

When openclaw (running as UID 998) makes an LLM call, the proxy intercepts the Bearer openshell:resolve:env:OPENAI_API_KEY header, looks up OPENAI_API_KEY from the sandbox's attached inference provider, and replaces it with the real key before forwarding to the upstream LLM gateway.

ClawBackend.EnsureAgentHarness calls attachMessagingProviders to attach Slack providers but never creates or attaches an inference provider. The sandbox is created without one — the proxy has nothing to resolve and closes the connection.

Fix

Added upsertInferenceProviderForHarness wired into EnsureAgentHarness:

1. Reads the ModelConfig referenced by the AgentHarness
2. Resolves the API key from the referenced k8s secret
3. Calls UpsertInferenceProvider on the OpenShell gRPC API with {OPENAI_API_KEY, OPENAI_BASE_URL}
4. Passes the provider name into attachMessagingProviders so the sandbox is created with the provider attached

The sandbox process never holds the real key — credential resolution happens in the proxy at request time, preserving the OpenShell security model.

Files Changed

• openclaw.go — EnsureAgentHarness wired to call upsertInferenceProviderForHarness and pass provider into sandbox spec
• providers.go — new UpsertInferenceProvider method
• openclaw/modelconfig.go — InferenceProviderName helper
• openclaw/provider.go — exported BootstrapProviderBaseURL wrapper
• translate.go — phase fallback fix (related: AgentHarness: phaseToCondition should fall back to status.conditions when phase=UNSPECIFIED #1958)

Testing

Validated end-to-end on a local kind cluster with a Slack bot (socket mode) backed by an OpenAI-compatible LiteLLM gateway. Bot receives messages and returns LLM responses after this fix.

Notes

• This is a draft PR to share the code alongside the bug report — happy to iterate on the approach
• The translate.go phase fix is bundled here but tracked separately in AgentHarness: phaseToCondition should fall back to status.conditions when phase=UNSPECIFIED #1958

[nloke]

Fixes #1965