fix(security): centralize owner-only tool gating and scope maps

src/agents/openclaw-gateway-tool.e2e.test.ts

@@ -17,23 +17,15 @@ vi.mock("./tools/gateway.js", () => ({
 }));
 
 describe("gateway tool", () => {
-  it("rejects non-owner callers explicitly", async () => {
-    const { callGatewayTool } = await import("./tools/gateway.js");
+  it("marks gateway as owner-only", async () => {
     const tool = createOpenClawTools({
-      senderIsOwner: false,
       config: { commands: { restart: true } },
     }).find((candidate) => candidate.name === "gateway");
     expect(tool).toBeDefined();
     if (!tool) {
       throw new Error("missing gateway tool");
     }
-
-    await expect(
-      tool.execute("call-owner-check", {
-        action: "config.get",
-      }),
-    ).rejects.toThrow("Tool restricted to owner senders.");
-    expect(callGatewayTool).not.toHaveBeenCalled();
+    expect(tool.ownerOnly).toBe(true);
   });
 
   it("schedules SIGUSR1 restart", async () => {