Fix shared model authentication recovery

[angnuoli]

Summary

• store GitHub Copilot credentials in OpenClaw's fixed main agent store so all personas can inherit them
• distinguish missing provider credentials from Copilot token failures and open the appropriate model setup flow without resending failed prompts
• restore visible Allow once and Always allow actions for high-risk external app approvals by adding danger-color fallbacks

Validation

• targeted desktop and renderer Vitest suites
• desktop and renderer production build
• full build.ps1 installer/portable packaging