feat: 内置虾盘云 + 设备指纹绑定 + Release 流水线

- 新增 portable/lib/{fingerprint,xiapan-client,bootstrap-xiapan}.mjs：
  跨平台设备指纹（Win USB/disk + Mac UUID + Linux machine-id + seed 兜底）
  生成 sk-uc-{fingerprint} 形式的虾盘云 apiKey，启动时 merge 到 openclaw.json
- Config.html 顶部新增「已绑定虾盘云」横幅：指纹来源 + Key + 余额 + 充值/解绑
- config-server 增加 /api/xiapan/{status,bind,unbind} 三个端点
- Electron app 在 whenReady 调 bootstrap，新增 sync-lib.js 让 build 前自动同步
- 锁 OpenClaw 版本到 2026.4.29（OPENCLAW_VERSION 单一来源）
- 删除死代码 portable/充值.html
- 新增 .github/workflows/release.yml：tag 触发，出 portable zip + Electron exe/dmg
- README 增加内置虾盘云说明 + 直接下载发行版指引

.github/workflows/release.yml

@@ -0,0 +1,209 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to publish (e.g. v2.1.0). Leave empty to use the most recent tag.'
+        required: false
+        default: ''
+
+permissions:
+  contents: write
+
+jobs:
+  portable-windows:
+    name: Portable Windows zip
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Read OpenClaw version
+        id: openclaw_version
+        shell: bash
+        run: |
+          version=$(tr -d '[:space:]' < OPENCLAW_VERSION)
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Run portable setup (Windows)
+        shell: cmd
+        run: |
+          cd portable
+          call setup.bat
+
+      - name: Stage portable folder
+        shell: bash
+        run: |
+          mkdir -p dist
+          tag_name="${GITHUB_REF_NAME:-${{ github.event.inputs.tag }}}"
+          stage_dir="dist/u-claw-portable-windows-${tag_name}"
+          mkdir -p "$stage_dir"
+          cp -R portable/. "$stage_dir/"
+          # Drop dev-only large files we don't ship
+          rm -rf "$stage_dir/data/logs" 2>/dev/null || true
+
+      - name: Zip portable
+        shell: pwsh
+        run: |
+          $tag = if ($env:GITHUB_REF_NAME) { $env:GITHUB_REF_NAME } else { '${{ github.event.inputs.tag }}' }
+          $stage = "dist/u-claw-portable-windows-$tag"
+          $out = "dist/u-claw-portable-windows-$tag.zip"
+          Compress-Archive -Path "$stage/*" -DestinationPath $out -CompressionLevel Optimal
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: portable-windows
+          path: dist/u-claw-portable-windows-*.zip
+
+  portable-mac:
+    name: Portable macOS zip
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Run portable setup (mac)
+        run: |
+          cd portable
+          bash setup.sh
+
+      - name: Stage portable folder
+        run: |
+          mkdir -p dist
+          tag_name="${GITHUB_REF_NAME:-${{ github.event.inputs.tag }}}"
+          stage_dir="dist/u-claw-portable-mac-${tag_name}"
+          mkdir -p "$stage_dir"
+          cp -R portable/. "$stage_dir/"
+          rm -rf "$stage_dir/data/logs" 2>/dev/null || true
+
+      - name: Zip portable
+        run: |
+          tag_name="${GITHUB_REF_NAME:-${{ github.event.inputs.tag }}}"
+          cd dist
+          zip -qry "u-claw-portable-mac-${tag_name}.zip" "u-claw-portable-mac-${tag_name}"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: portable-mac
+          path: dist/u-claw-portable-mac-*.zip
+
+  desktop-windows:
+    name: Electron Windows installer
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Install dependencies
+        shell: cmd
+        run: |
+          cd u-claw-app
+          npm install --registry=https://registry.npmmirror.com
+
+      - name: Build Windows installer
+        shell: cmd
+        run: |
+          cd u-claw-app
+          npm run build:win
+        env:
+          # Skip code signing — we ship unsigned. README documents the SmartScreen workaround.
+          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: desktop-windows
+          path: |
+            u-claw-app/release/*.exe
+            u-claw-app/release/*.exe.blockmap
+
+  desktop-mac:
+    name: Electron macOS DMG
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Install dependencies
+        run: |
+          cd u-claw-app
+          npm install --registry=https://registry.npmmirror.com
+
+      - name: Build macOS DMG
+        run: |
+          cd u-claw-app
+          npm run build:mac-arm64
+        env:
+          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: desktop-mac
+          path: |
+            u-claw-app/release/*.dmg
+            u-claw-app/release/*.dmg.blockmap
+
+  publish:
+    name: Publish GitHub Release
+    needs: [portable-windows, portable-mac, desktop-windows, desktop-mac]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: Resolve tag
+        id: tag
+        run: |
+          if [ -n "${{ github.event.inputs.tag }}" ]; then
+            tag="${{ github.event.inputs.tag }}"
+          else
+            tag="${GITHUB_REF_NAME}"
+          fi
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+
+      - name: Read OpenClaw version
+        id: openclaw_version
+        run: |
+          version=$(tr -d '[:space:]' < OPENCLAW_VERSION)
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Create or update release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.tag.outputs.tag }}
+          name: U-Claw ${{ steps.tag.outputs.tag }}
+          body: |
+            ## U-Claw ${{ steps.tag.outputs.tag }}
+
+            - 内置虾盘云：首次启动自动绑定本机/U盘指纹，生成 `sk-...` apiKey
+            - OpenClaw runtime: `${{ steps.openclaw_version.outputs.version }}`
+            - 充值入口：https://u-claw.org/cloud.html
+
+            > Windows 安装包未做代码签名，首次运行需在 SmartScreen 选择"仍要运行"。
+            > macOS DMG 未做公证，首次启动需 `xattr -rd com.apple.quarantine /Applications/U-Claw.app` 或右键打开。
+          files: |
+            artifacts/portable-windows/*
+            artifacts/portable-mac/*
+            artifacts/desktop-windows/*
+            artifacts/desktop-mac/*
+          fail_on_unmatched_files: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}