OpenClaw: macOS optional allowlist basename matching could bypass path-based policy

Summary On macOS node-host, optional exec-approval allowlist mode previously treated basename-only entries for example echo as trusted command matches. This could allow a same-name local binary for example ./echo to run without approval under security=allowlist + ask=on-miss. Scope / Precondition...