add-heartbeat

SUSPICIOUS: the stated purpose is legitimate system heartbeat monitoring, but the actual footprint is broader and partially inconsistent with verified official OpenClaw mechanisms. The main risks are autonomous scheduled execution, commands sourced from an editable HEARTBEAT.md, and undocumented IPC registration paths; there is no evidence of credential theft, remote payload download, or confirmed malware.