fix(build): isolate bundled runtime dependency staging

scripts/stage-bundled-plugin-runtime-deps.mjs

@@ -1,6 +1,7 @@
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
@@ -22,6 +23,25 @@ function makeTempDir(parentDir, prefix) {
   return fs.mkdtempSync(path.join(parentDir, prefix));
 }
 
+function sanitizeTempPrefixSegment(value) {
+  const normalized = value.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/-+/g, "-");
+  return normalized.length > 0 ? normalized : "plugin";
+}
+
+function replaceDir(targetPath, sourcePath) {
+  removePathIfExists(targetPath);
+  try {
+    fs.renameSync(sourcePath, targetPath);
+    return;
+  } catch (error) {
+    if (error?.code !== "EXDEV") {
+      throw error;
+    }
+  }
+  fs.cpSync(sourcePath, targetPath, { recursive: true, force: true });
+  removePathIfExists(sourcePath);
+}
+
 function listBundledPluginRuntimeDirs(repoRoot) {
   const extensionsRoot = path.join(repoRoot, "dist", "extensions");
   if (!fs.existsSync(extensionsRoot)) {
@@ -220,7 +240,10 @@ function installPluginRuntimeDeps(params) {
   const { fingerprint, packageJson, pluginDir, pluginId } = params;
   const nodeModulesDir = path.join(pluginDir, "node_modules");
   const stampPath = resolveRuntimeDepsStampPath(pluginDir);
-  const tempInstallDir = makeTempDir(pluginDir, ".runtime-deps-");
+  const tempInstallDir = makeTempDir(
+    os.tmpdir(),
+    `openclaw-runtime-deps-${sanitizeTempPrefixSegment(pluginId)}-`,
+  );
   const npmRunner = resolveNpmRunner({
     npmArgs: [
       "install",
@@ -255,8 +278,7 @@ function installPluginRuntimeDeps(params) {
       );
     }
 
-    removePathIfExists(nodeModulesDir);
-    fs.renameSync(stagedNodeModulesDir, nodeModulesDir);
+    replaceDir(nodeModulesDir, stagedNodeModulesDir);
     writeJson(stampPath, {
       fingerprint,
       generatedAt: new Date().toISOString(),