chore: roll forward to OpenClaw rename

What:
- update pin bump workflow to select OpenClaw-*.zip (not legacy Clawdbot assets)
- modernize updater to use `nix flake update --update-input …`
- standardize HM app install paths to OpenClaw.app

Why:
- upstream renamed Clawdbot -> OpenClaw; we should pin the current artifacts
- ensure pin bumps pull in upstream model catalog / pi updates

Tests:
- bash -n scripts/update-pins.sh

nix/modules/home-manager/openclaw/config.nix

@@ -27,7 +27,7 @@ let
     app = {
       install = {
         enable = false;
-        path = "${homeDir}/Applications/Openclaw.app";
+        path = "${homeDir}/Applications/OpenClaw.app";
       };
     };
   };
@@ -115,7 +115,7 @@ let
     else {
       name = lib.removePrefix "${homeDir}/" inst.app.install.path;
       value = {
-        source = "${appPackage}/Applications/Openclaw.app";
+        source = "${appPackage}/Applications/OpenClaw.app";
         recursive = true;
         force = true;
       };
@@ -223,8 +223,8 @@ in {
     home.file = lib.mkMerge [
       (lib.listToAttrs (map (item: item.homeFile) instanceConfigs))
       (lib.optionalAttrs (pkgs.stdenv.hostPlatform.isDarwin && appPackage != null && cfg.installApp) {
-        "Applications/Openclaw.app" = {
-          source = "${appPackage}/Applications/Openclaw.app";
+        "Applications/OpenClaw.app" = {
+          source = "${appPackage}/Applications/OpenClaw.app";
           recursive = true;
           force = true;
         };

nix/modules/home-manager/openclaw/options-instance.nix

@@ -116,13 +116,13 @@
     app.install.enable = lib.mkOption {
       type = lib.types.bool;
       default = false;
-      description = "Install Openclaw.app for this instance.";
+      description = "Install OpenClaw.app for this instance.";
     };
 
     app.install.path = lib.mkOption {
       type = lib.types.str;
-      default = "${openclawLib.homeDir}/Applications/Openclaw.app";
-      description = "Destination path for this instance's Openclaw.app bundle.";
+      default = "${openclawLib.homeDir}/Applications/OpenClaw.app";
+      description = "Destination path for this instance's OpenClaw.app bundle.";
     };
 
     appDefaults = {

nix/modules/home-manager/openclaw/options.nix

@@ -73,7 +73,7 @@ in {
     installApp = lib.mkOption {
       type = lib.types.bool;
       default = true;
-      description = "Install Openclaw.app at the default location.";
+      description = "Install OpenClaw.app at the default location.";
     };
 
     stateDir = lib.mkOption {

nix/scripts/openclaw-app-install.sh

@@ -3,7 +3,9 @@ set -e
 mkdir -p "$out/Applications"
 app_path="$(find "$src" -maxdepth 2 -name '*.app' -print -quit)"
 if [ -z "$app_path" ]; then
-  echo "Openclaw.app not found in $src" >&2
+  echo "OpenClaw.app not found in $src" >&2
   exit 1
 fi
-cp -R "$app_path" "$out/Applications/Openclaw.app"
+
+# Canonical name going forward
+cp -R "$app_path" "$out/Applications/OpenClaw.app"

scripts/update-pins.sh

@@ -1,6 +1,11 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+if [[ "${GITHUB_ACTIONS:-}" != "true" ]]; then
+  echo "This script is intended to run in GitHub Actions (see .github/workflows/yolo-update.yml). Refusing to run locally." >&2
+  exit 1
+fi
+
 repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 source_file="$repo_root/nix/sources/openclaw-source.nix"
 app_file="$repo_root/nix/packages/openclaw-app.nix"
@@ -46,7 +51,7 @@ if ! command -v jq >/dev/null 2>&1; then
 fi
 
 log "Updating nix-steipete-tools input"
-nix flake lock --update-input nix-steipete-tools
+nix flake update --update-input nix-steipete-tools --accept-flake-config
 
 log "Resolving openclaw main SHAs"
 mapfile -t candidate_shas < <(gh api /repos/openclaw/openclaw/commits?per_page=10 | jq -r '.[].sha' || true)
@@ -138,16 +143,16 @@ if [[ -z "$release_json" ]]; then
   echo "Failed to fetch release metadata" >&2
   exit 1
 fi
-release_tag=$(printf '%s' "$release_json" | jq -r '[.[] | select([.assets[]?.name | (test("^Clawdbot-.*\\.zip$") and (test("dSYM") | not))] | any)][0].tag_name // empty')
+release_tag=$(printf '%s' "$release_json" | jq -r '[.[] | select([.assets[]?.name | (test("^OpenClaw-.*\\.zip$") and (test("dSYM") | not))] | any)][0].tag_name // empty')
 if [[ -z "$release_tag" ]]; then
-  echo "Failed to resolve a release tag with a Clawdbot app asset" >&2
+  echo "Failed to resolve a release tag with an OpenClaw app asset" >&2
   exit 1
 fi
 log "Latest app release tag with asset: $release_tag"
 
-app_url=$(printf '%s' "$release_json" | jq -r '[.[] | select([.assets[]?.name | (test("^Clawdbot-.*\\.zip$") and (test("dSYM") | not))] | any)][0].assets[] | select(.name | (test("^Clawdbot-.*\\.zip$") and (test("dSYM") | not))) | .browser_download_url' | head -n 1 || true)
+app_url=$(printf '%s' "$release_json" | jq -r '[.[] | select([.assets[]?.name | (test("^OpenClaw-.*\\.zip$") and (test("dSYM") | not))] | any)][0].assets[] | select(.name | (test("^OpenClaw-.*\\.zip$") and (test("dSYM") | not))) | .browser_download_url' | head -n 1 || true)
 if [[ -z "$app_url" ]]; then
-  echo "Failed to resolve Clawdbot app asset URL from latest release" >&2
+  echo "Failed to resolve OpenClaw app asset URL from latest release" >&2
   exit 1
 fi
 log "App asset URL: $app_url"