feat(agent): complete EvoAgent integration for all 6 agent roles

Migrate all agent roles from Legacy to EvoAgent architecture:
- fundamentals_analyst, technical_analyst, sentiment_analyst, valuation_analyst
- risk_manager, portfolio_manager

Key changes:
- EvoAgent now supports Portfolio Manager compatibility methods (_make_decision,
  get_decisions, get_portfolio_state, load_portfolio_state, update_portfolio)
- Add UnifiedAgentFactory for centralized agent creation
- ToolGuard with batch approval API and WebSocket broadcast
- Legacy agents marked deprecated (AnalystAgent, RiskAgent, PMAgent)
- Remove backend/agents/compat.py migration shim
- Add run_id alongside workspace_id for semantic clarity
- Complete integration test coverage (13 tests)
- All smoke tests passing for 6 agent roles

Constraint: Must maintain backward compatibility with existing run configs
Constraint: Memory support must work with EvoAgent (no fallback to Legacy)
Rejected: Separate PM implementation for EvoAgent | unified approach cleaner
Confidence: high
Scope-risk: broad
Directive: EVO_AGENT_IDS env var still respected but defaults to all roles
Not-tested: Kubernetes sandbox mode for skill execution

backend/apps/openclaw_service.py

@@ -1,5 +1,21 @@
 # -*- coding: utf-8 -*-
-"""Read-only OpenClaw CLI FastAPI surface."""
+"""Read-only OpenClaw CLI FastAPI surface.
+
+COMPATIBILITY_SURFACE: deferred
+OWNER: runtime-team
+SEE: docs/legacy-inventory.md#openclaw-dual-integration
+
+This is the REST facade (port 8004) for OpenClaw integration.
+For the WebSocket gateway integration, see:
+  - backend/services/gateway_openclaw_handlers.py
+  - shared/client/openclaw_websocket_client.py
+
+Key differences:
+- REST facade: typed Pydantic models, request/response, polling
+- WebSocket: event-driven, real-time updates, bidirectional
+
+Decision needed: which surface becomes the long-term contract?
+"""
 
 from __future__ import annotations