fix(release): Windows-only portable bundle with pre-installed deps

Root cause: portable zip was 1MB skeleton; first launch triggered
`npm install` of OpenClaw + 36 bundled deps on customer's USB drive.
On exFAT-formatted USB this hangs/takes 20+ minutes, gateway never
binds 18789, dashboard shows "Gateway 未启动".

Fix follows StanleyChanH/openclaw-offline-package pattern (153MB
single-platform zip, gateway starts directly):

- release.yml: only build Windows bundle (~150-200MB). Mac users
  fall back to setup.sh. Reasoning: 99% of customers are Windows;
  bundling 3 platforms × Node ~30MB + 3× node_modules dedup pain
  is what blew the previous attempt past GitHub's 2GB cap (see
  5916ff5 history). Smaller scope = simpler + safer.
- Windows-Start.bat / Mac-Start.command: warn if node_modules
  missing; fallback `npm install` adds --ignore-scripts --no-audit
  --no-fund for speed.
- Release notes: NTFS U-disk recommendation.

Lessons applied (from 5916ff5):
- Stay on linux runner with --ignore-scripts (Stanley pattern)
- Drop mac-x64 / mac-arm64 Node from bundle (setup.sh handles Mac)
- rm -rf node-llama-cpp / sharp / canvas explicitly
- Hard size guard: fail CI if zip > 1500MB (buffer below 2GB cap)

portable/Mac-Start.command

@@ -98,10 +98,12 @@ export OPENCLAW_CONFIG_PATH="$CONFIG_FILE"
 
 # ---- 7. Check dependencies ----
 if [ ! -d "$CORE_DIR/node_modules" ]; then
-    echo -e "  ${YELLOW}First run - installing dependencies...${NC}"
-    echo "  (Using China mirror)"
+    echo -e "  ${YELLOW}[WARN] node_modules not found${NC}"
+    echo "  This release should ship with deps pre-installed."
+    echo "  Falling back to npm install (USB drives may take 20+ min)."
+    echo "  TIP: re-download u-claw-portable-*.zip with bundled deps."
     cd "$CORE_DIR"
-    "$NODE_BIN" "$NODE_DIR/bin/npm" install --registry=https://registry.npmmirror.com 2>&1
+    "$NODE_BIN" "$NODE_DIR/bin/npm" install --registry=https://registry.npmmirror.com --ignore-scripts --no-audit --no-fund --omit=dev 2>&1
     echo -e "  ${GREEN}Dependencies installed${NC}"
     echo ""
 fi
@@ -111,6 +113,16 @@ echo -e "  ${CYAN}Binding device fingerprint to Xiapan Cloud...${NC}"
 UCLAW_APP_ROOT="$UCLAW_DIR" "$NODE_BIN" "$UCLAW_DIR/lib/bootstrap-xiapan.mjs" "$CONFIG_FILE" || true
 echo ""
 
+# ---- 7c. Async update check (non-blocking, 5s timeout, silent failure) ----
+# Writes data/.openclaw/update-available.json if a newer version is on OSS.
+# Welcome.html / Config.html read this file and show a banner.
+# Version file lookup: portable/OPENCLAW_VERSION (USB) → ../OPENCLAW_VERSION (dev)
+VERSION_FILE="$UCLAW_DIR/OPENCLAW_VERSION"
+[ -f "$VERSION_FILE" ] || VERSION_FILE="$UCLAW_DIR/../OPENCLAW_VERSION"
+if [ -f "$VERSION_FILE" ]; then
+    "$NODE_BIN" "$UCLAW_DIR/lib/check-update.mjs" "$VERSION_FILE" "$STATE_DIR" >/dev/null 2>&1 &
+fi
+
 # ---- 8. Find available port ----
 PORT=18789
 while lsof -i :$PORT >/dev/null 2>&1; do

portable/Windows-Start.bat

@@ -62,11 +62,19 @@ if not exist "%STATE_DIR%\openclaw.json" (
 
 REM Check dependencies
 if not exist "%CORE_DIR%\node_modules" (
-    echo   First run - installing dependencies...
-    echo   Using China mirror, please wait...
+    echo   ========================================
+    echo   [WARN] node_modules not found
+    echo   ========================================
+    echo   This release should ship with deps pre-installed.
+    echo   Falling back to npm install (USB drives may take 20+ minutes).
+    echo.
+    echo   TIP: Re-download u-claw-portable-*.zip from GitHub releases,
+    echo        which includes pre-installed deps (~200 MB).
+    echo.
+    echo   File system: NTFS recommended. exFAT/FAT32 will be very slow.
     echo.
     cd /d "%CORE_DIR%"
-    call "%NPM_BIN%" install --registry=https://registry.npmmirror.com
+    call "%NPM_BIN%" install --registry=https://registry.npmmirror.com --ignore-scripts --no-audit --no-fund --omit=dev
     echo.
     echo   Dependencies installed!
     echo.
@@ -78,6 +86,17 @@ set "UCLAW_APP_ROOT=%UCLAW_DIR%"
 "%NODE_BIN%" "%UCLAW_DIR%lib\bootstrap-xiapan.mjs" "%STATE_DIR%\openclaw.json"
 echo.
 
+REM Async update check (non-blocking, 5s timeout, silent failure)
+REM Writes data\.openclaw\update-available.json if a newer version is on OSS.
+REM Welcome.html / Config.html read this file and show a banner.
+REM Version file lookup order: portable/OPENCLAW_VERSION (USB), then repo-root ../OPENCLAW_VERSION (dev)
+set "VERSION_FILE=%UCLAW_DIR%OPENCLAW_VERSION"
+if not exist "%VERSION_FILE%" set "VERSION_FILE=%UCLAW_DIR%..\OPENCLAW_VERSION"
+if exist "%VERSION_FILE%" (
+    start /B "" "%NODE_BIN%" "%UCLAW_DIR%lib\check-update.mjs" "%VERSION_FILE%" "%STATE_DIR%" >nul 2>&1
+)
+
+
 REM Auto-install WeChat plugin if available
 set "WECHAT_PLUGIN_SRC=%APP_DIR%\extensions\openclaw-weixin"
 set "WECHAT_PLUGIN_DST=%USERPROFILE%\.openclaw\extensions\openclaw-weixin"