fix: tighten package tag coverage

src/infra/package-tag.test.ts

@@ -12,6 +12,7 @@ describe("normalizePackageTagInput", () => {
   it("strips known package-name prefixes before returning the tag", () => {
     expect(normalizePackageTagInput("openclaw@beta", packageNames)).toBe("beta");
     expect(normalizePackageTagInput("@openclaw/plugin@2026.2.24", packageNames)).toBe("2026.2.24");
+    expect(normalizePackageTagInput("openclaw@   ", packageNames)).toBeNull();
   });
 
   it("returns trimmed raw values when no package prefix matches", () => {

src/infra/package-tag.ts

@@ -10,7 +10,8 @@ export function normalizePackageTagInput(
   for (const packageName of packageNames) {
     const prefix = `${packageName}@`;
     if (trimmed.startsWith(prefix)) {
-      return trimmed.slice(prefix.length);
+      const tag = trimmed.slice(prefix.length).trim();
+      return tag ? tag : null;
     }
   }