Install OpenClaw to DigitalOcean

A wizard that takes a non-DevOps user from zero to a working OpenClaw bot on a fresh DigitalOcean Droplet in ~15 minutes. The user does exactly three-or-four things: paste a DigitalOcean API token, paste a Telegram bot token, paste an LLM API key (or say "Codex" for OAuth via ChatGPT subscription), press /start in Telegram once, and — only for Codex — confirm a device code on auth.openai.com. Everything else is silent.

This is the DigitalOcean sibling of install-openclaw-to-yc. The flow, the cloud-init, the hardening, the Telegram pairing and the verification are identical. What differs is the provider plumbing: doctl instead of yc, an API token instead of a Yandex OAuth dance, a Cloud Firewall instead of a security group, and no cheap "stop the VM" pause (DO bills powered-off Droplets — see Step 6 / references/04).

Operating principles (the "don't bother the user" rules)

These rules override the rest of the document. Read them first.

1. Three inputs. Total. The only things you ask the user for are the DigitalOcean API token (Step 0), the Telegram bot token, and the LLM access (one of three options — see Step 1). Everything else — Droplet name, region, image, size, SSH key, firewall ingress, chat_id — is decided silently from safe defaults or auto-detected.
2. Never ask "are you sure" for actions inside this wizard's own scope (creating its own Droplet, its own firewall, its own bot pairing). Only confirm if you're about to destroy something the user might want to keep (an existing Droplet with the same name).
3. Never show shell commands, flags, paths, or stack traces to the user unless they explicitly ask "what did you run?". Progress is plain language: "Создаю Droplet…", "Ставлю OpenClaw…", "Проверяю что бот отвечает…".
4. Validate inputs upfront with a one-call test (doctl account get, Telegram /getMe, LLM key probe). Don't burn 15 minutes on a Droplet bootstrap with a bad key.
5. Auto-fix prerequisites silently when it's safe — install doctl, generate an SSH key, upload it to the account. Only stop and ask the user when something can't be done without their input (the API token itself, no payment method on the account).
6. One language — and the bot speaks it too. If the user wrote to the agent in Russian, all wizard prompts are in Russian, and the OpenClaw bot itself is configured to reply in Russian. Detect the user's language from their first few messages, pass it through to cloud-init as {{USER_LANGUAGE}} (ISO 639-1: ru/en/kk/...), and the bootstrap script appends a localization block to the bot's USER.md. Default if you can't tell: ru (workshop audience).
7. No emojis in user-facing text unless the user used them first.

Do NOT ask the user for these (hard override)