fix(openclaw): improve credential detection in extraction instructions

The previous exclude rule for credentials was too generic ("even if shared
in conversation") and the extraction LLM failed to recognize credentials
embedded in config blocks, setup logs, and tool output.

New rule gives the LLM concrete patterns to watch for (sk-, m0-, ak_, ghp_,
bot tokens, bearer tokens, webhook URLs, pairing codes) and WRONG/RIGHT
examples showing what to store instead of the raw secret.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

openclaw/config.ts

@@ -111,7 +111,9 @@ LANGUAGE:
 - If the user speaks Spanish, store the memory in Spanish; do not translate
 
 Exclude (NEVER store):
-- Passwords, API keys, tokens, secrets, or any credentials — even if shared in conversation. Instead store: "Tavily API key was configured and saved to .env (as of 2026-02-20)"
+- Passwords, API keys, tokens, secrets, or any credentials — even when embedded in configuration blocks, setup logs, or tool output. This includes strings starting with sk-, m0-, ak_, ghp_, bot tokens (digits followed by colon and alphanumeric string), bearer tokens, webhook URLs containing tokens, pairing codes, and any long alphanumeric strings that appear in config/env contexts. Never include the actual secret value in a memory. Instead, record that the credential was configured:
+  WRONG: "User's API key is sk-abc123..." or "Bot token is 12345:AABcd..."
+  RIGHT: "API key was configured for the service (as of YYYY-MM-DD)" or "Telegram bot token was set up"
 - One-time commands or instructions ("stop the script", "continue where you left off")
 - Acknowledgments or emotional reactions ("ok", "sounds good", "you're right", "sir")
 - Transient UI/navigation states ("user is in the admin panel", "relay is attached")