feat(openclaw): add Nix-built Docker image with app extraction from upstream
Pure Nix buildLayeredImage that extracts /app from upstream ghcr.io/openclaw/openclaw
via manifest-aware Python script. Avoids fromImage which breaks Debian
dynamic linker by shadowing /lib -> usr/lib symlink.
Includes: nix, nodejs_22, kubectl, jq, curl, git, emacs, python3+pymupdf, tea.
Custom NSS with node user (UID 1000). Replicated docker-entrypoint.sh.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
John Ogle
3faad15a02