Hot-reload browser profile config

Browser profile edits such as browser.profiles.sandbox.cdpUrl were classified under a broad browser restart rule, so profile-only config changes could schedule a gateway restart even though the profile connection details should be adjustable without disrupting the running gateway.

Added browser.profiles as a hot-reload prefix, sorted reload rules by longest prefix so narrow rules override broad owner fallbacks, pinned gateway reload policy to the HTTP route registry surface, and covered both direct reload planning and authenticated config.patch behavior.

• Enables dynamic browser profile endpoint updates without forcing a full OpenClaw gateway restart.
• Keeps high-impact browser settings such as browser.enabled and browser.defaultProfile restart-scoped.
• Reduces disruption for sandboxed browser workflows and active agent sessions that depend on profile-specific CDP endpoints.

• Added reload-plan coverage for browser.profiles.sandbox.cdpUrl hot reload under the broad browser restart rule.
• Added authenticated config.patch coverage proving browser profile-only writes do not schedule a direct restart in hot mode.
• PR validation included focused gateway/browser tests, formatting, linting, diff checks, and the full OpenClaw build.