feat: add AIEOS identity support and harden cron scheduler security

- Add IdentityConfig with format=openclaw|aieos, aieos_path, and aieos_inline
- Implement AIEOS v1.1 JSON parser and system prompt injection
- Add build_system_prompt_with_identity() supporting both OpenClaw markdown and AIEOS JSON
- Harden cron scheduler with SecurityPolicy checks (command allowlist, forbidden path arguments)
- Skip retries on deterministic security policy violations
- Add comprehensive tests for AIEOS config and cron security edge cases
- Update README with AIEOS documentation and schema overview
- Add .dockerignore tests for build context security validation

src/config/schema.rs

@@ -68,7 +68,7 @@ pub struct IdentityConfig {
     /// Only used when format = "aieos"
     #[serde(default)]
     pub aieos_path: Option<String>,
-    /// Inline AIEOS JSON (alternative to aieos_path)
+    /// Inline AIEOS JSON (alternative to `aieos_path`)
     /// Only used when format = "aieos"
     #[serde(default)]
     pub aieos_inline: Option<String>,