fix: revert register() to sync with ready-guard initPromise for secret resolution

Make register() synchronous again (OpenClaw loader does not await it).
All hook/tool registrations happen immediately; embedder, retriever, and
smartExtractor are initialized in a fire-and-forget initPromise that
resolves async secrets. Every hook that uses these awaits initPromise
before proceeding. register() returns initPromise so awaiting callers
(tests, host implementations that do support async) can still wait.

Also fix:
- bws access token passed via BWS_ACCESS_TOKEN env var instead of
  --access-token CLI arg to avoid exposure in process listings
- embedder double-resolveEnvVars: skip expansion if key lacks ${}
- selfImprovement: { enabled: false } in sessionDefaultApi,
  sessionEnabledApi, and session-summary harness to isolate assertions
  from the now-default-true selfImprovement feature

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Coke1120