Supervise and persist ClawdBox node host

manifests/deployment.yaml

@@ -58,8 +58,10 @@ spec:
               value: noninteractive
             - name: TZ
               value: UTC
+            - name: CLAWDBOX_START_NODE
+              value: "false"
             - name: OPENCLAW_VERSION
-              value: "2026.6.1"
+              value: "2026.7.2-beta.3"
             - name: OPENCLAW_GATEWAY_HOST
               value: openclaw.apps.lab.apilab.us
             - name: OPENCLAW_GATEWAY_PORT
@@ -110,6 +112,56 @@ spec:
             capabilities:
               drop: ["ALL"]
               add: ["NET_BIND_SERVICE"]
+        - name: openclaw-node
+          image: default-route-openshift-image-registry.apps.lab.apilab.us/clawdbox/clawdbox:latest
+          imagePullPolicy: Always
+          command:
+            - /bin/bash
+            - -lc
+            - |
+              set -eu
+              /usr/local/bin/start-clawdbox-node
+              PID=$(cat /data/agents/clawd/logs/node-host.pid)
+              while kill -0 "$PID"; do
+                sleep 5
+              done
+              exit 1
+          env:
+            - name: HOME
+              value: /data/agents/clawd/node-home
+            - name: OPENCLAW_STATE_DIR
+              value: /data/agents/clawd/node-home/.openclaw
+            - name: KUBECONFIG
+              value: /home/claw/.kube/config
+            - name: OPENCLAW_VERSION
+              value: "2026.7.2-beta.3"
+            - name: OPENCLAW_GATEWAY_HOST
+              value: openclaw.apps.lab.apilab.us
+            - name: OPENCLAW_GATEWAY_PORT
+              value: "443"
+            - name: OPENCLAW_GATEWAY_TLS
+              value: "true"
+            - name: CLAWDBOX_NODE_DISPLAY_NAME
+              value: ClawdBox-CLI
+          volumeMounts:
+            - mountPath: /data
+              name: data-volume
+            - mountPath: /home/claw/.kube
+              name: kubeconfig-secret
+              readOnly: true
+          resources:
+            limits:
+              memory: "768Mi"
+              cpu: "500m"
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
       volumes:
         - name: data-volume
           persistentVolumeClaim: