fix(agent): selected-project follow-ups and OpenClaw workflow scan

[Timverhoogt]

Why

A silent real-provider check after deploying #66 read the real raw-photo-agent roadmap successfully, but the short follow-up What is next? triggered catalog rediscovery and failed with explicit_private_intent_required.

Changes

• Advertise only read_project_roadmap for a recognized project follow-up, with a request-local enum containing the already-selected project ID.
• Reject catalog rediscovery and reads of another registered roadmap server-side before file access; preserve the existing private-intent guard instead of weakening it.
• Tell the model to reread that exact roadmap directly and distinguish an open milestone from the latest explicit next step.
• Add regressions for selected-ID schema scope, malicious rediscovery/cross-project calls, and shared-manifest nonmutation.
• Record deployed read-only catalog/source checks and a read-only OpenClaw workflow-support scan. No OpenClaw settings or authority changed.

Verification

• New follow-up regressions failed against feat(agent): source-grounded project roadmap conversations #66 (3 failures), then passed after the fix.
• 929 non-browser tests passed; 77 focused project/OpenClaw tests passed.
• 23 Chromium tests rerun on the feat(agent): source-grounded project roadmap conversations #66 UI; this fix does not change static assets.
• Ruff and whitespace passed; documentation citations verified.
• feat(agent): source-grounded project roadmap conversations #66 live probes verified both registered roadmap hashes, exact revision-70 HTTPS assets, unpaired Workspace 401, preserved configuration, and folded Standby with motors disabled.

Owner-supervised voice/motion acceptance and the actual coding/session-execution increment remain separate. This PR does not grant coding tools or native session authority.