fix(pack,friend): foreign file:// card_url resilience (spec-145/138 follow-up)

[antonyevans]

Bug (found live on the rig, first post-merge T14 run)

0.15.x-era cards advertise their own home as card_url: file:///opt/data/home/.openclaw/edge-book/openclaw-agent.json. Once such a contact exists, re-resolving it on ANOTHER machine hits the spec-138 local-contact fallback → loadCard(file://…) → raw ENOENT. Live repro: pack join rig-test re-run failed its replica member, violating spec-145's idempotent-re-join promise. The whole 0.15.1 fleet's cards have this shape, so any friend request <handle> re-run against an existing contact was exposed.

Fix (two layers)

1. pack join: pre-resolution skip by contact alias — idempotency no longer depends on the member being re-resolvable at all.
2. resolveFriendRequestCard: when the stored card_url fails to load, fall back to non-local resolution (registry) instead of surfacing an fs error — fixes plain friend request re-runs too.

Verification

506/506 tests (2 new regressions: foreign card_url pack re-join skips cleanly; friend request falls back to registry), lint 0 errors, typecheck/build green. Live rig matrix returns to all-pass with this build.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 529ccc0d81

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Do not fall back on invalid stored cards

When a stored local contact's card_url is reachable but returns a malformed, expired, or forged card, this broad catch suppresses the invalid_card/card_expired failure and retries through the registry if the same target is resolvable there. That changes a validation failure for a known contact into a successful request to whatever the non-local provider returns; the registry provider itself deliberately rethrows validation errors, so this fallback should be limited to access/fetch failures such as foreign file:// paths rather than all loadCard errors.

Useful? React with 👍 / 👎.