chore(sync): OpenClaw v2026.5.26 upstream sync

[iPythoning]

Summary

• Release: v2026.5.22 → v2026.5.26 (May 27, 2026 · 100+ contributors)
• CHANGELOG + README updated with v2026.5.26 highlights
• Blog EN published: https://pulseagent.io/en/blog/openclaw-v2026-5-26-faster-gateway-security-reaction-approvals
• Blog ZH published: https://pulseagent.io/zh/blog/openclaw-v2026-5-26-faster-gateway-security-reaction-approvals
• WeChat: v2026.5.26 enqueued (HTTP 500 server error; appsecret outage ongoing — queue is now 16 items, self-heals when backend is fixed)

What's in v2026.5.26

• Gateway startup optimization — plugin/channel/session metadata cached on first load; no more repeated scans on restart
• Security hardening — SSRF policy on browser snapshots, prompt-injection sanitization, external content boundaries, stale token rejection, ClickClack sender allowlists, tool-call serialization scrubbed from replies
• Reaction-based approvals — Signal, iMessage, WhatsApp: operators approve agent actions via emoji reaction, no text commands needed
• Realtime Talk controls — inspectable, steerable, cancellable from Web UI and Discord; wake-name ambient-speech tolerance improved
• Activity tab + OpenTelemetry — sanitized tool-activity summaries in Web UI; OTel LLM spans for gateway ops; new telemetry signals for blocked tools, failover, stale sessions
• Transcript-backed architecture — meeting summaries + media provenance in persistent queryable store (foundation for meeting-aware SDR follow-ups)
• Sharp → Rastermill — image processing drop-in replacement with better Alpine Linux support

Test plan

• CHANGELOG entry renders correctly
• README banner updated to v2026.5.26
• Blog EN accessible at published URL
• Blog ZH accessible at published URL
• WeChat queue drains automatically once appsecret 40125 is fixed in PulseAgent backend

https://claude.ai/code/session_01VcWjePJVKEDF3URhoNi2j8

---

Generated by Claude Code