Granular personal notes access for limiting OpenClaw blast-radius

Giving a self-hosted OpenClaw agent read/write access to one Obsidian folder via Docker volume mounts, rclone bisync, and GPT OCR for handwritten notes.