[Ubuntu 24.04][Onboard] Hermes Portable crashes with an uncaught exception on pre-existing gateway state instead of a clean recovery error

The Hermes Portable (rootless-Podman) onboarding flow shares its gateway state directory with the default Docker-driver onboarding flow. When that directory already holds state from a different driver or a different provider identity — including state written by this same NemoClaw installation's own default (Docker-driver) onboarding, or by an earlier interrupted Portable attempt — Portable onboarding does not detect and handle this gracefully. Instead it throws an uncaught exception (a raw Node.js stack trace, not a normal `[ERROR]`-prefixed CLI message) and aborts with no recovery guidance.

Platform scope: Reproduced on Ubuntu 24.04 only; other platforms not tested.
Regression: No — this is new functionality (the experimental Hermes Portable profile).
OpenShell issue: No

## Environment

```text
Device: x86_64 Linux server, NVIDIA GPU
OS: Ubuntu 24.04.4 LTS
Architecture: x86_64
Node.js: v22.23.2
npm: 10.9.8
Docker: 29.5.2
OpenShell CLI: 0.0.106
NemoClaw: v0.0.114
OpenClaw: N/A (onboard did not reach sandbox creation)
```

## Steps to Reproduce

Two independent ways to reach the same class of failure were found:

**Path A (cross-driver collision):**
1. Install NemoClaw fresh. Let the installer's own default (Docker-driver) onboarding attempt run at least far enough to write its gateway config (it does not need to complete — it can fail later for an unrelated reason, e.g. a missing credential).
2. Run:
```bash
nemohermes onboard --experimental-profile portable --fresh
```

**Path B (stale provider identity from an earlier Portable attempt):**
1. Run:
```bash
nemohermes onboard --experimental-profile portable --fresh
```
2. Let it register an inference provider on the gateway, then abandon the attempt before it fully completes.
3. Run the identical command again:
```bash
nemohermes onboard --experimental-profile portable --fresh
```

## Expected Result

Portable onboarding either reconciles or clearly rejects pre-existing, incompatible gateway state with an actionable CLI error (naming what is wrong and how to recover), the same way other preflight checks in this product do. It should not exit via an unhandled exception, and a normal sequence of "try the default flow, then try the Portable flow" (or "retry the Portable flow after an interruption") should not require reinstalling the product to recover from.

## Actual Result

Path A fails with:

```text
Refusing to rewrite {path}/openshell-gateway.toml: NemoClaw cannot prove
its generated gateway identity (the config does not match NemoClaw's schema)

Node.js v22.23.2
[raw stack trace through docker-driver-gateway-config.js]
```

Path B fails with a different message, same shape:

```text
Error: Hermes Portable inference found ambiguous gateway provider authority.

Node.js v22.23.2
[raw stack trace through hermes-portable-ollama-gateway-transaction.js]
```

Both are uncaught exceptions presented as raw stack traces rather than a formatted CLI error, and neither points to a way to recover short of a full product uninstall and reinstall.

## Related

#9575 — a closely related pattern reported for the separate managed-llama.cpp local-inference feature: a persisted "engine authority" record for a runtime that was interrupted before it ever finished being created blocks all further reinstall attempts, and no uninstall variant clears it either. Different feature, same architectural shape: a per-feature state/identity record that is written before the operation it describes has actually completed, is not rolled back on interruption, and has no exposed reset path.
#10056 — "[Epic] Consolidate the experimental Portable runtime and lifecycle contract for OpenClaw and Hermes." Tracking epic for the broader feature area this defect belongs to.

## Logs

Path A (verbatim):
```text
[1/8] Preflight checks
Refusing to rewrite {state-dir}/openshell-gateway.toml: NemoClaw cannot prove its generated gateway identity (the config does not match NemoClaw's schema)
Node.js v22.23.2
```

Path B (verbatim):
```text
[3/8] Configuring inference provider
Error: Hermes Portable inference found ambiguous gateway provider authority.
at observeExactGatewayProvider (hermes-portable-ollama-gateway-transaction.js)
Node.js v22.23.2
```