fix: add localhost to allowedOrigins for A2A bridge WS connection

The A2A bridge connects via ws://127.0.0.1:7860 which OpenClaw
validates against controlUi.allowedOrigins. Added localhost origins.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/sync_hf.py

@@ -420,6 +420,8 @@ class OpenClawFullSync:
             allowed_origins = [
                 "https://huggingface.co",
                 "https://*.hf.space",
+                "http://127.0.0.1:7860",
+                "http://localhost:7860",
             ]
             if SPACE_HOST:
                 allowed_origins.append(f"https://{SPACE_HOST}")