The OpenClaw runtime validates that resolved symlinks stay within /app/dist/extensions/. When /app was a Nix store symlink, realpath resolved to /nix/store/ which 'escaped' the boundary. Now we copy the app files into /app as a real directory in extraCommands.