Simplify env-builder import flow and prevent accidental auto-apply

Handle additional uncaught exceptions in iframe-fix

resolve merge conflict

refactor: clean up iframe-fix.cjs code style and remove deprecated OpenClaw scope patch from start.sh

feat: enable iframe embedding by injecting a preload script to strip security headers and update CSP policies