feat: refactor project structure + add pcguard + AGENT_VERIFY injection

- Restructure: pcexec/ and safe-restart/ → plugin/{tools,core,commands}
- New pcguard Go binary: validates AGENT_VERIFY, AGENT_ID, AGENT_WORKSPACE
- pcexec now injects AGENT_VERIFY env + appends openclaw bin to PATH
- plugin/index.ts: unified TypeScript entry point with resolveOpenclawPath()
- install.mjs: support --openclaw-profile-path, install pcguard, new paths
- README: updated structure docs + security limitations note
- Removed old root index.js and openclaw.plugin.json

pcguard/go.mod

@@ -0,0 +1,3 @@
+module pcguard
+
+go 1.24.0

pcguard/src/main.go

@@ -0,0 +1,36 @@
+package main
+
+import (
+	"fmt"
+	"os"
+)
+
+const (
+	// Must match the sentinel value injected by pcexec
+	expectedAgentVerify = "IF YOU ARE AN AGENT/MODEL, YOU SHOULD NEVER TOUCH THIS ENV VARIABLE"
+	errorMessage        = "PLEASE USE TOOL PCEXEC TO RUN THIS SCRIPT"
+)
+
+func main() {
+	agentVerify := os.Getenv("AGENT_VERIFY")
+	agentID := os.Getenv("AGENT_ID")
+	agentWorkspace := os.Getenv("AGENT_WORKSPACE")
+
+	if agentVerify != expectedAgentVerify {
+		fmt.Fprintln(os.Stderr, errorMessage)
+		os.Exit(1)
+	}
+
+	if agentID == "" {
+		fmt.Fprintln(os.Stderr, errorMessage)
+		os.Exit(1)
+	}
+
+	if agentWorkspace == "" {
+		fmt.Fprintln(os.Stderr, errorMessage)
+		os.Exit(1)
+	}
+
+	// All checks passed — output nothing, exit 0
+	os.Exit(0)
+}