Sync chart from pieced-operator 0.1.48

deploy/helm/pieced-operator/templates/catalog-cm.yaml

@@ -297,6 +297,30 @@ data:
         egress_rules:
           - namespace: threema-gateway
             port: 8080
+        # OpenClaw 2026.5.x loads external plugins from
+        # /data/extensions/<dir>/openclaw.plugin.json. Three gates must
+        # be open for the runtime to register an external plugin:
+        #   1. plugins.enabled: true             — feature flag
+        #   2. plugins.allow contains the id     — security allowlist
+        #   3. plugins.entries.<id>.enabled: true — per-plugin toggle
+        # Cedric's personal instance.yaml hand-codes the same three gates
+        # for his direct `openclaw-channel-threema` plugin; this patch
+        # generates them automatically for every tenant that enables
+        # threema. The init container that copies the plugin onto the
+        # PVC is emitted by the operator (plugin_image below).
+        config_patch:
+          plugins:
+            enabled: true
+            allow:
+              - "threema"
+            entries:
+              threema:
+                enabled: true
+                config: {}
+        plugin_image:
+          repository: registry.c5ai.ch/pieced/openclaw-channel-threema-relay
+          tag: "0.1.0"
+          target_dir: openclaw-channel-threema-relay
         customer_instructions: |
           1. Once enabled, register the Threema IDs you want to receive
              messages from under "Authorized Users → threema".