fix(build): default OPENCLAW_BASE_VERSION to latest for standalone builds

[VirtualVapor502]

问题

首次执行 make install-embedded 时 Manager 镜像构建失败：
higress-registry.cn-hangzhou.cr.aliyuncs.com/agentteams/openclaw-base:20260423-8359cbc: not found

根因

Makefile 中 OPENCLAW_BASE_VERSION 硬编码的 tag 20260423-8359cbc 在默认区域镜像仓库（cn-hangzhou）不存在，而 latest tag 存在且可拉取。变量上方的注释也写明 "Default: latest (for standalone builds)"，与代码行为不一致。

修复

将默认值改为 latest，与注释一致。需要版本化基础镜像时仍可通过 OPENCLAW_BASE_VERSION=<tag> 覆盖，不影响 push/build-all 等显式传参的场景。

验证

1. 复现问题：旧 tag 在 cn-hangzhou 镜像仓库不存在

$ docker manifest inspect higress-registry.cn-hangzhou.cr.aliyuncs.com/agentteams/openclaw-base:20260423-8359cbc
no such manifest: higress-registry.cn-hangzhou.cr.aliyuncs.com/agentteams/openclaw-base:20260423-8359cbc

2. 验证修复：latest tag 存在且可拉取（含 amd64 + arm64 多架构）

$ docker manifest inspect higress-registry.cn-hangzhou.cr.aliyuncs.com/agentteams/openclaw-base:latest
{
   "schemaVersion": 2,
   "mediaType": "application/vnd.oci.image.index.v1+json",
   "manifests": [
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 1256,
         "digest": "sha256:e7ae44d96e605243c31fdbe3917f2730dfa7924e698aa291ee139aa1afe15ad0",
         "platform": {
            "architecture": "amd64",
            "os": "linux"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 1256,
         "digest": "sha256:9f8710ac0e8845c7eb943659350f8e849497b6d26bda616700b6d1460b78f0bb",
         "platform": {
            "architecture": "arm64",
            "os": "linux"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 565,
         "digest": "sha256:f58c942d07080764b46aa0089b8a3c1238a7bb01dac7faff7c2b5e3654496f8c",
         "platform": {
            "architecture": "unknown",
            "os": "unknown"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 565,
         "digest": "sha256:25df28d4465a356dd39508252583b133ae43eed4ffc853edbf98b28764007812",
         "platform": {
            "architecture": "unknown",
            "os": "unknown"
         }
      }
   ]
}

3. 修复后构建通过

$ make install-embedded
...
==> Building Manager image: agentteams/manager:latest
# 构建不再报 openclaw-base:20260423-8359cbc not found，Manager/Worker 镜像成功构建
✅ install-embedded 完成

结论：默认值改为 latest 后，全新环境的 make install-embedded 可正常完成；
需要版本化基础镜像时仍可通过 OPENCLAW_BASE_VERSION=<tag> 显式覆盖。

环境

• AgentTeams: main (45eb463)
• OS: Windows 11
• Docker: desktop-linux

影响范围

• 仅修改 Makefile 一行默认值
• 不影响显式传参的构建（build-all / push 仍可指定版本化 base）
• 修复中国区用户首次构建失败的体验问题

[oss-maintainer]

Summary

Changes the default OPENCLAW_BASE_VERSION from the pinned tag 20260423-8359cbc to latest, aligning the Makefile with its own comment. The change is mechanically safe — only standalone build paths consume the default, all CI/release paths override it explicitly, and the ?= override is preserved. However, the stated root cause could not be reproduced: the pinned tag exists and is pullable in the default registry today, so the reported first-time make install-embedded failure is not explained by this pin. Worth confirming the original failure mode (likely registry mirror/namespace related, which latest would not fix) before merging.

Findings

• [Warning] Makefile:142 — the pinned tag 20260423-8359cbc exists in higress-registry.cn-hangzhou.cr.aliyuncs.com/agentteams/openclaw-base (verified via registry API, multi-arch, anonymously pullable); the reported breakage does not reproduce with the current registry state.
• [Info] Makefile:142 — mechanically safe: only OPENCLAW_BASE_BUILD_ARG/OPENCLAW_BASE_PUSH_ARG consume it; build/push-openclaw-base use separate vars; every CI path overrides explicitly; latest currently matches the v1.2.3 release base digest.
• [Info] Makefile:142 — follow-ups: this reverses the re-pinning policy documented in build-rc.yml; the old tag remains hardcoded in worker/Dockerfile, manager/Dockerfile, hack/local-k8s-up.sh, manager/docker-legacy/Dockerfile.aliyun, and test-integration.yml.

---

Automated review by github-manager-bot

[oss-maintainer]

The PR's justification is factually incorrect as of today: the pinned tag DOES exist in the default registry. Verified live against the registry API: higress-registry.cn-hangzhou.cr.aliyuncs.com/agentteams/openclaw-base:20260423-8359cbc returns HTTP 200 as a multi-arch manifest list (linux/amd64 + linux/arm64, image created 2026-04-23) and is anonymously pullable (tags list: 20260423-8359cbc, -amd64, -arm64, latest, v1.1.2, v1.2.0-beta.1, v1.2.0-v1.2.3). It also exists in the higress/openclaw-base namespace used by hack/local-k8s-up.sh and test-integration.yml:285. So first-time make install-embedded does not fail on the base pull with the pin. The claim likely stems from the registry-namespace migration window noted in test-integration.yml:283-284 ('The pinned base predates the AgentTeams registry namespace... until a release seeds the new repo') — the agentteams repo has since been seeded, so the stated breakage no longer reproduces. Note also that the regional mirrors (us-west-1, ap-southeast-7) reject anonymous pulls for the whole repository for BOTH tags equally (repo-level auth), so latest would not fix a mirror-related failure either. The change itself is mechanically safe (see info notes), but the root cause of the reported breakage was not verified.

[oss-maintainer]

Mechanically safe — verified all consumers of OPENCLAW_BASE_VERSION: it feeds only OPENCLAW_BASE_BUILD_ARG (build-manager Makefile:156, build-worker Makefile:180) and OPENCLAW_BASE_PUSH_ARG (push-manager Makefile:347/360, push-worker Makefile:406/418). push-openclaw-base and build-openclaw-base use OPENCLAW_BASE_TAG/VERSION instead and are unaffected. Every CI path that needs a pinned base overrides it explicitly (build.yml:110,132 with the release version; build-rc.yml:88 with inputs.version; test-integration.yml:280,285), so release builds remain reproducible. The ?= override mechanism is preserved. latest exists in the default registry (multi-arch, rebuilt by build-base.yml on every openclaw-base/** push to main) and currently has the same digest as the v1.2.3 release base (sha256:1392e9be...), so standalone builds match the latest release — arguably better than the stale April pin, which no longer matches what released v1.2.3 images were actually built against.

[oss-maintainer]

Two follow-ups for maintainers: (1) This silently reverses the documented pinning policy in build-rc.yml:122-125, whose RC summary instructs 'After RC validation, update base image dependency to the stable tag: OPENCLAW_BASE_VERSION ?= -' (the removed pin was exactly such a tag, per changelog/v1.1.0.md 'chore(base): pin openclaw-base image tag to 20260423-8359cbc'). Either update build-rc.yml's guidance or accept that the next RC cycle may re-pin this default. (2) The de-pin is incomplete: 20260423-8359cbc remains hardcoded in worker/Dockerfile:14 and manager/Dockerfile:14 (ARG fallback defaults, only used when building the Dockerfiles directly without the Makefile), hack/local-k8s-up.sh:89/95/109, manager/docker-legacy/Dockerfile.aliyun:15, and test-integration.yml:285 — the latter three point at the higress/ namespace. Not blockers since those paths are self-consistent and the tag exists in both namespaces, but the repo is now inconsistent about which base tag is canonical.