fix(release): Windows-only portable bundle with pre-installed deps

Root cause: portable zip was 1MB skeleton; first launch triggered
`npm install` of OpenClaw + 36 bundled deps on customer's USB drive.
On exFAT-formatted USB this hangs/takes 20+ minutes, gateway never
binds 18789, dashboard shows "Gateway 未启动".

Fix follows StanleyChanH/openclaw-offline-package pattern (153MB
single-platform zip, gateway starts directly):

- release.yml: only build Windows bundle (~150-200MB). Mac users
  fall back to setup.sh. Reasoning: 99% of customers are Windows;
  bundling 3 platforms × Node ~30MB + 3× node_modules dedup pain
  is what blew the previous attempt past GitHub's 2GB cap (see
  5916ff5 history). Smaller scope = simpler + safer.
- Windows-Start.bat / Mac-Start.command: warn if node_modules
  missing; fallback `npm install` adds --ignore-scripts --no-audit
  --no-fund for speed.
- Release notes: NTFS U-disk recommendation.

Lessons applied (from 5916ff5):
- Stay on linux runner with --ignore-scripts (Stanley pattern)
- Drop mac-x64 / mac-arm64 Node from bundle (setup.sh handles Mac)
- rm -rf node-llama-cpp / sharp / canvas explicitly
- Hard size guard: fail CI if zip > 1500MB (buffer below 2GB cap)

portable/Mac-Start.command

@@ -98,10 +98,12 @@ export OPENCLAW_CONFIG_PATH="$CONFIG_FILE"
 
 # ---- 7. Check dependencies ----
 if [ ! -d "$CORE_DIR/node_modules" ]; then
-    echo -e "  ${YELLOW}First run - installing dependencies...${NC}"
-    echo "  (Using China mirror)"
+    echo -e "  ${YELLOW}[WARN] node_modules not found${NC}"
+    echo "  This release should ship with deps pre-installed."
+    echo "  Falling back to npm install (USB drives may take 20+ min)."
+    echo "  TIP: re-download u-claw-portable-*.zip with bundled deps."
     cd "$CORE_DIR"
-    "$NODE_BIN" "$NODE_DIR/bin/npm" install --registry=https://registry.npmmirror.com 2>&1
+    "$NODE_BIN" "$NODE_DIR/bin/npm" install --registry=https://registry.npmmirror.com --ignore-scripts --no-audit --no-fund --omit=dev 2>&1
     echo -e "  ${GREEN}Dependencies installed${NC}"
     echo ""
 fi
@@ -111,6 +113,16 @@ echo -e "  ${CYAN}Binding device fingerprint to Xiapan Cloud...${NC}"
 UCLAW_APP_ROOT="$UCLAW_DIR" "$NODE_BIN" "$UCLAW_DIR/lib/bootstrap-xiapan.mjs" "$CONFIG_FILE" || true
 echo ""
 
+# ---- 7c. Async update check (non-blocking, 5s timeout, silent failure) ----
+# Writes data/.openclaw/update-available.json if a newer version is on OSS.
+# Welcome.html / Config.html read this file and show a banner.
+# Version file lookup: portable/OPENCLAW_VERSION (USB) → ../OPENCLAW_VERSION (dev)
+VERSION_FILE="$UCLAW_DIR/OPENCLAW_VERSION"
+[ -f "$VERSION_FILE" ] || VERSION_FILE="$UCLAW_DIR/../OPENCLAW_VERSION"
+if [ -f "$VERSION_FILE" ]; then
+    "$NODE_BIN" "$UCLAW_DIR/lib/check-update.mjs" "$VERSION_FILE" "$STATE_DIR" >/dev/null 2>&1 &
+fi
+
 # ---- 8. Find available port ----
 PORT=18789
 while lsof -i :$PORT >/dev/null 2>&1; do