feat(security): commandsSyncKey is a required channel-config field (Guild C-2)

The slash-command sync secret now comes from
channels.fabric.commandsSyncKey (configSchema marks it required) and
is no longer read from FABRIC_COMMANDS_SYNC_KEY env. command-sync
resolves it from config and threads it into client.syncCommands;
when absent, sync is skipped with a clear warning. README updated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dist/fabric/src/command-sync.js

@@ -6,6 +6,7 @@
 // dynamic arg `choices` to a static snapshot here (like Discord does at
 // registration time).
 import { listNativeCommandSpecsForConfig, findCommandByNativeName, resolveCommandArgChoices, } from 'openclaw/plugin-sdk/native-command-registry';
+import { resolveCommandsSyncKey } from './accounts.js';
 function normChoice(c) {
     if (typeof c === 'string')
         return { value: c, label: c };
@@ -62,6 +63,14 @@ export function buildFabricCommandSpecs(cfg) {
 // Push the catalog to every guild the known agents belong to (idempotent;
 // the catalog is OpenClaw-global, so one PUT per guild is enough).
 export async function syncFabricCommands(client, cfg, accounts, log) {
+    // Guild C-2: the sync key comes from the channel config only (schema
+    // marks it required). Without it the guild rejects the catalog write.
+    const syncKey = resolveCommandsSyncKey(cfg);
+    if (!syncKey) {
+        log.warn('fabric: channels.fabric.commandsSyncKey is not set — skipping ' +
+            'slash-command sync (set it to the guild FABRIC_BACKEND_GUILD_COMMANDS_SYNC_KEY)');
+        return;
+    }
     let specs;
     try {
         specs = buildFabricCommandSpecs(cfg);
@@ -88,7 +97,7 @@ export async function syncFabricCommands(client, cfg, accounts, log) {
             if (!tok)
                 continue;
             try {
-                await client.syncCommands(g.endpoint, tok, specs);
+                await client.syncCommands(g.endpoint, tok, specs, syncKey);
                 done.add(g.nodeId);
                 log.info(`fabric: synced ${specs.length} slash command(s) -> ${g.nodeId}`);
             }