[Ubuntu 24.04][Onboard] Hermes Portable --fresh does not clear stale gateway-provider journal, blocking retry after an abandoned attempt

`nemohermes onboard --experimental-profile portable --fresh` durably fails with "Hermes Portable inference gateway provider journal authority changed" (or the sibling message "...journal is malformed"/"...journal identity is malformed") when retried against a sandbox name used by an earlier, abandoned attempt. `--fresh` only clears the onboarding session checkpoint; it does not clear the separate, sandbox-name-scoped journal file this experimental flow writes, so the only way to retry cleanly is a full product uninstall and reinstall.

Platform scope: Reproduced on Ubuntu 24.04 only; other platforms not tested.
Regression: No — this is new functionality (the experimental Hermes Portable profile); not something that previously worked.
OpenShell issue: No

## Environment

```text
Device: x86_64 Linux server, NVIDIA GPU
OS: Ubuntu 24.04.4 LTS
Architecture: x86_64
Node.js: v22.23.2
npm: 10.9.8
Docker: 29.5.2
OpenShell CLI: 0.0.106
NemoClaw: v0.0.114
OpenClaw: N/A (onboard did not reach sandbox creation)
```

## Steps to Reproduce

1. Run:
```bash
nemohermes onboard --experimental-profile portable --fresh
```
2. Let it reach the provider/inference-gateway setup step, then interrupt or abandon the attempt before it completes (any way of not finishing works — Ctrl+C, or letting a later unrelated step fail).
3. Run the identical command again, targeting the same sandbox name (the default name is reused automatically when none is given):
```bash
nemohermes onboard --experimental-profile portable --fresh
```

## Expected Result

`--fresh` starts a genuinely clean attempt: the second run either succeeds or fails on its own merits, not because of state left behind by the first, abandoned attempt.

## Actual Result

The second run fails immediately with an uncaught-looking error, exit 1:

```text
Error: Hermes Portable inference gateway provider journal authority changed.
```

No further onboarding steps run. Re-running with `--fresh` again reproduces the identical failure every time — there is no CLI flag or documented recovery step that clears it. The only way found to retry cleanly was to fully uninstall NemoClaw (including user data) and reinstall from scratch, which also removes every other sandbox and all product configuration on the host, not just the affected attempt.

This is not the first time `--fresh` has failed to clear all onboarding-related recovery state — see Related. Those were each fixed for the specific piece of state involved (main onboard-session/provider recovery cache, and installer directory permissions); this is a new, separate file introduced by the newer Hermes Portable experimental profile that those fixes do not cover.

## Related

#5719 — "--fresh does not clear provider-recovery; non-interactive auto-recovers a provider from a non-existent sandbox." Same general pattern (`--fresh` not clearing all recovery state), fixed for the main onboard-session/sandbox-registry provider cache specifically — does not cover this newer, portable-profile-specific journal file.
#9211 — "[Epic] Qualify Hermes as an experimental portable agent on rootless Podman." Tracking epic for the broader feature this defect belongs to.

## Logs

```text
Rebuild sandbox 'hermes'
Current: OpenClaw v2026.7.1
Target: OpenClaw v2026.7.1
[... preflight and gateway-reuse steps pass ...]
Error: Hermes Portable inference gateway provider journal authority changed.
at parse (hermes-portable-ollama-gateway-transaction.js)
Node.js v22.23.2
```