Fix clw-memory-crash: Resolve OpenClaw Memory Corruption Crashes

On Linux/macOS, this triggers a SIGSEGV or SIGABRT, often with core dumps. Windows shows a "Access Violation" dialog or Dr. Watson crash report:

Symptoms escalate under load: random crashes during asset loading, entity spawning, or physics updates. Heap validation tools like Valgrind report:

Performance degrades pre-crash: high CPU usage, stuttering frames. Logs fill with warnings like "CLW_MEM_WARN: Heap inconsistency at block 0x...".

## 2. Root Cause

OpenClaw uses a custom slab allocator (`clw_alloc`, `clw_free`) for efficient game object pooling, bypassing `malloc`/`free` for low-latency allocation. The `clw-memory-crash` triggers when:

1. **Use-after-free**: Freeing a slab then accessing it (e.g., in destructors).
2. **Double-free**: Freeing the same pointer twice.
3. **Buffer overflow/underflow**: Writing beyond slab bounds corrupts metadata (magic bytes, size fields).
4. **Uninitialized pointers**: Passing garbage to `clw_free`.

Internally, `clw_free` validates pointers via a bitmap and magic header (0xCLW_MAGIC). Corruption flips bits or overwrites headers, failing checks:

```c
// Simplified clw_memory.c excerpt
#define CLW_MAGIC 0x434C57AAu  // "CLW\xaa"

typedef struct clw_slab {
    uint32_t magic;
    size_t size;
    uint8_t data[];
} clw_slab_t;

void clw_free(void* ptr) {
    if (!ptr) return;
    clw_slab_t* slab = (clw_slab_t*)((char*)ptr - sizeof(clw_slab_t));
    if (slab->magic != CLW_MAGIC) {
        fprintf(stderr, "clw-memory-crash at clw_free(%p): Invalid pointer %p\n", ptr, slab);
        abort();
    }
    // Return to freelist...
}

cmake -DCMAKE_BUILD_TYPE=Debug \
      -DOPENCLAW_ASAN=ON \
      -DOPENCLAW_UBSAN=ON ..
make -j$(nproc)

valgrind --tool=memcheck --track-origins=yes --leak-check=full ./your_game

// main.cpp:45 - BROKEN
class GameObject {
    clw_ptr data;  // OpenClaw's clw_alloc wrapper, but misused
public:
    ~GameObject() {
        if (data) clw_free(data);  // Double-free if reset() called
    }
    void reset() {
        if (data) {
            clw_free(data);  // First free
            data = nullptr;
        }
    }
};

void destroy_object(GameObject* obj) {
    obj->reset();  // Frees
    obj->~GameObject();  // Frees again -> clw-memory-crash
}

// FIXED with std::unique_ptr and clw_deleter
struct clw_deleter {
    void operator()(void* ptr) {
        if (ptr) clw_free(ptr);
    }
};
using clw_unique_ptr = std::unique_ptr<void, clw_deleter>;

class GameObject {
    clw_unique_ptr data;
public:
    void reset() {
        data.reset();  // Safe single free
    }
    ~GameObject() = default;  // Managed by unique_ptr
};

void destroy_object(std::unique_ptr<GameObject> obj) {
    obj.reset();  // Single RAII cleanup, no double-free
}

// engine.cpp: Overrun
void update_physics(GameObject* obj, float dt) {
    float* pos = (float*)obj->data;
    pos[100] += dt * 10.0f;  // Overflow if slab < 400 bytes
}

// FIXED
void update_physics(GameObject* obj, float dt) {
    clw_slab_t* slab = clw_get_slab(obj->data);
    if (!slab || slab->size < 400) {
        fprintf(stderr, "CLW Bounds error\n");
        return;
    }
    float* pos = (float*)obj->data;
    pos[100] += dt * 10.0f;
}

==1234== ERROR SUMMARY: 0 errors from 0 contexts

==1234== All heap blocks were freed -- no leaks

./stress_test --iterations 10000 --seed 42
# Expect: PASSED, no crashes

if (!clw_validate_heap()) {
    fprintf(stderr, "Heap corrupted!\n");
    exit(1);
}