Rebuild with Brave Search logs provider-profile "already exists" collision — destructive on some hosts, non-fatal on others

## Description

Running `nemoclaw {sandbox} rebuild` on a sandbox that has Brave Search configured (a directly-requested policy preset, part of the default Balanced tier) reliably logs a provider-profile import error naming an "already exists" collision on the Brave provider profile — this diagnostic noise reproduces deterministically across every host tested. However, the consequence of that error varies by host: on the original host, rebuild destroyed the sandbox and failed to recreate it twice in a row, with no successful recovery. On a separate, independently re-verified clean host, the identical diagnostic text appeared on every attempt (5/5), but rebuild still completed successfully to a healthy Ready sandbox each time despite it — the error is host-conditionally non-fatal there. The underlying "already exists" collision itself is confirmed general (also matches #7097, a previously-filed and closed report on a third host/platform), but whether it escalates into a destructive, unrecoverable rebuild failure is not yet understood — possibly depends on additional host state, timing, or a condition not yet isolated.

**Platform scope:** The underlying "already exists" diagnostic reproduces on DGX Station and DGX Spark. The destructive/unrecoverable outcome was only observed on the original DGX Station host; a DGX Spark host showed the same diagnostic but rebuild completed successfully both times.

**Regression:** Unknown — a related report (#7097) against an earlier version described the same "already exists" symptom for a different specific failure mode (credential validation, since fixed); this exact failure/its severity was not independently retested between versions before now.

## Environment

```text
Device: DGX Station GB300 (destructive outcome) / DGX Spark (non-fatal outcome, same diagnostic)
OS: Ubuntu 24.04 (DGX OS / DGX Spark OS)
Architecture: aarch64
Node.js: v22.23.2
npm: 10.9.8
Docker: 29.2.1
OpenShell CLI: 0.0.106
NemoClaw: v0.0.114
OpenClaw: N/A on the DGX Station reproduction (rebuild never completed there); healthy on DGX Spark (rebuild completed both times)
```

## Steps to Reproduce

1. Onboard a sandbox using the default Balanced policy tier, with Brave Search web-search enabled.
2. Confirm the sandbox works normally (connect, exec, inference all succeed).
3. Run:
```bash
nemoclaw {sandbox} rebuild --yes
```
4. Observe the provider-profile diagnostic in the output, then check whether the rebuild actually completed (sandbox reaches Ready again) or failed to recreate the sandbox.
5. Repeat once more to check whether the outcome (fatal vs non-fatal) is consistent on the same host.

## Expected Result

Rebuild does not attempt to re-create a provider profile that already exists in the first place (the import should be idempotent, skip-if-exists), so no "already exists" diagnostic should appear at all, and rebuild always completes successfully.

## Actual Result

Every tested rebuild attempt with Brave Search configured logs this diagnostic:

```text
Provider profile diagnostics:
error .../provider-profiles/brave.yaml
profile=brave field=id custom provider profile 'brave' already exists
Error: × provider profile import failed
```

On the original reproduction host, this was followed by a hard failure — the sandbox was destroyed and rebuild could not recreate it, on two separate attempts:

```text
Recovery recreate failed.
Your local registry entry has been preserved - you can retry once the issue above is fixed.
```

On a second, independently tested host, the identical diagnostic appeared on every attempt but rebuild still completed successfully to a healthy Ready sandbox both times — the error appears to be non-fatal there. The underlying provider-profile-already-exists collision is confirmed and reproducible everywhere tested; what determines whether it also destroys the sandbox is not yet isolated.

## Logs

```text
$ nemoclaw openclaw-up rebuild --yes
Provider profile diagnostics:
error .../provider-profiles/brave.yaml
profile=brave field=id custom provider profile 'brave' already exists
Error: × provider profile import failed

[Original host - fatal outcome:]
Recovery recreate failed.
Your local registry entry has been preserved - you can retry once the issue above is fixed.

[Second host - non-fatal outcome, same diagnostic:]
[... same provider-profile diagnostic lines ...]
Sandbox rebuilt successfully.
```

Start by reproducing `nemoclaw {sandbox} rebuild --yes` with Brave Search enabled and compare the provider-profile diagnostic with the final sandbox state on the two described host conditions. Done means the existing Brave profile is handled idempotently, the collision diagnostic is absent, and rebuild consistently reaches Ready without destroying the sandbox.

Written by the indexing model from the issue text.